RSA Authentication Manager 8.2 False Positive Security Vulnerabilities
2 years ago
Originally Published: 2017-04-20
Article Number
000064248
Applies To
RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.2
CVE Identifier(s)
CVE-2016-7916,CVE-2016-9794,CVE-2016-8633,CVE-2017-5551,CVE-2016-9756,CVE-2015-1350,CVE-2017-313
Article Summary
This article provides a list of security vulnerabilities that cannot be exploited on RSA Authentication Manager 8.2, but which may be flagged by security scanners.
Alert Impact
Not Exploitable
Alert Impact Explanation
False Positive
Resolution
The vulnerabilities listed in the table below are in order by the date on which RSA Authentication Manager Engineering determined that the Authentication Manager 8.2 was not vulnerable.
Embedded ComponentCVE IDSummary of VulnerabilityReason why Product is not VulnerableDate Determined False Positive
Linux kernelCVE-2016-7916CVE-2016-7916Response: The flaw exists but does not additional risk.19-Apr-17
  
Race condition in the environ_read function in fs/proc/base.c in the Linux kernel before 4.5.4 allows local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file during a process-setup time interval in which environment-variable copying is incomplete.The RSA Authentication Manager appliance is a secure system with a single appliance administrator capable of logging in. It is not a multi-purpose/multi-user system with non-privileged local users. The appliance administrator is already capable of obtaining root privileges
  
CVSS v3 Base Score: 5.5 Medium 
Linux kernelCVE-2016-9794CVE-2016-9794Response: The flaw exists but does not additional risk.19-Apr-17
  
Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted SNDRV_PCM_TRIGGER_START command.The RSA Authentication Manager appliance is a secure system with a single appliance administrator capable of logging in. It is not a multi-purpose/multi-user system with non-privileged local users. The appliance administrator is already capable of obtaining root privileges.
  
CVSS v3 Base Score: 7.8 High 
Linux kernelCVE-2016-8633CVE-2016-8633Response: The flaw does not exist19-Apr-17
  
drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via crafted fragmented packets.The RSA Authentication Manager appliance does not support this driver.
  
CVSS v3 Base Score: 6.8 Medium 
Linux kernelCVE-2017-5551CVE-2017-5551Response: The flaw exists but does not additional risk.19-Apr-17
  
The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7097.The RSA Authentication Manager appliance is a secure system with a single appliance administrator capable of logging in. It is not a multi-purpose/multi-user system with non-privileged local users. The appliance administrator is already capable of obtaining root privileges.
  
CVSS v3 Base Score: 4.4 Medium 
Linux kernelCVE-2016-9756CVE-2016-9756Response: The flaw exists but does not additional risk.19-Apr-17
  
arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases, which allows local users to obtain sensitive information from kernel stack memory via a crafted applicationThe RSA Authentication Manager appliance is a secure system with a single appliance administrator capable of logging in. It is not a multi-purpose/multi-user system with non-privileged local users. The appliance administrator is already capable of obtaining root privileges.
  
CVSS v3 Base Score: 5.5 Medium 
Linux kernelCVE-2015-1350CVE-2015-1350Response: The flaw exists but does not additional risk.19-Apr-17
  
The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.The RSA Authentication Manager appliance is a secure system with a single appliance administrator capable of logging in. It is not a multi-purpose/multi-user system with non-privileged local users. The appliance administrator is already capable of obtaining root privileges.
  
CVSS v3 Base Score: 5.5 Medium 
ISC BINDCVE-2017-3135CVE-2017-3135Response: The flaw does not exist. 
   
A denial-of-service vulnerability that can affect resolvers using both DNS64 and RPZ to rewrite responses for the same view. (There is no description for this issue at NVD.)The RSA Authentication Manager appliance does not include the ISC BIND named service.19-Apr-17
Disclaimer
Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1- 800 995 5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, EMC Corporation, distributes RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall RSA, its affiliates or suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.

Related Articles

Trending Articles

Don't see what you're looking for?