This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
  • RSA.com
  • Home
  • Advisories
    • SecurID
    • SecurID Governance & Lifecycle
  • Documentation
    • SecurID
      • Authentication Agents
        • API / SDK
        • Apache Web Server
        • Citrix StoreFront
        • IIS Web Server
        • MFA Agent for macOS
        • MFA Agent for Windows
        • Microsoft AD FS
        • Microsoft Windows
        • PAM
      • Authentication Engine
      • Authentication Manager
      • Cloud Authentication Service
      • Hardware Appliance
        Component Updates
      • Hardware Tokens
      • Integrations
      • SecurID App
      • SecurID Authenticator for macOS
      • SecurID SDK
      • Software Tokens
        • Android
        • iOS
        • macOS
        • Token Converter
        • Windows
    • SecurID Governance & Lifecycle
    • Technology Partners
  • Downloads
    • SecurID
      • Authentication Agents
        • API / SDK
        • Apache Web Server
        • Citrix StoreFront
        • IIS Web Server
        • MFA Agent for macOS
        • MFA Agent for Windows
        • Microsoft AD FS
        • Microsoft Windows
        • PAM
      • Authentication Engine
      • Authentication Manager
      • Cloud Authentication Service
      • Hardware Appliance
        Component Updates
      • Hardware Tokens
      • Integrations
      • SecurID Authenticator for macOS
      • Software Tokens
        • Android
        • iOS
        • macOS
        • Token Converter
        • Windows
    • SecurID Governance & Lifecycle
  • Community
    • SecurID
      • Blog
      • Discussions
      • Events
      • Idea Exchange
      • Knowledge Base
    • SecurID Governance & Lifecycle
      • Blog
      • Discussions
      • Events
      • Idea Exchange
      • Knowledge Base
  • Support
    • Case Portal
      • Create New Case
      • View My Cases
      • View My Team's Cases
    • Community Support
      • Getting Started
      • News & Announcements
      • Ideas & Suggestions
      • Community Support Articles
      • Community Support Forum
    • Product Life Cycle
    • Support Information
    • General Security Advisories
  • Education
    • Blog
    • Browse Courses
      • SecurID
      • SecurID Governance & Lifecycle
    • Certification Program
    • New Product Readiness
    • Student Resources
Sign In Register Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Announcements

SecurID® Product Advisories

Read and subscribe to the latest announcements and advisories relating to the SecurID product.
  • SecurID Community
  • :
  • Products
  • :
  • SecurID
  • :
  • Advisories
  • :
  • Product Advisories
  • :
  • DSA-2020-183: RSA® Authentication Agent for PAM Uncontrolled Search Path Vulnerability
  • Options
    • Subscribe to RSS Feed
    • Bookmark
    • Subscribe
    • Email to a Friend
    • Printer Friendly Page
    • Report Inappropriate Content
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content

DSA-2020-183: RSA® Authentication Agent for PAM Uncontrolled Search Path Vulnerability

Dell EMC Identifier:DSA-2020-183
CVE Identifier:CVE-2020-5382
Severity:High
Severity Rating:8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected Products:
  • RSA® Authentication Agent for PAM version 8.1.1.66 and earlier
Summary:RSA Authentication Agent for PAM contains an Uncontrolled Search Path vulnerability.
Details:

The RSA Authentication Agent for PAM has been updated to address the following vulnerability:


RSA® Authentication Agent for PAM version 8.1.1.66 and earlier contains an Uncontrolled Search Path vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to elevate privileges to the root user.

CVSSv3 Base Score 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

For more information about any of the Common Vulnerabilities and Exposures (CVEs) mentioned here, consult the National Vulnerability Database (NVD) at http://nvd.nist.gov/home.cfm. To search for a particular CVE, use the database’s search utility at http://web.nvd.nist.gov/view/vuln/search.

Recommendation:

The following RSA Authentication Agent for PAM release contains resolutions to these vulnerabilities:

 

  • RSA® Authentication Agent for PAM version 8.1.1.106 and later


RSA recommends all customers upgrade at the earliest opportunity.

For additional documentation, downloads and more, visit the RSA SecurID Access page on RSA Link.
Credit:Dell would like to thank Casper Dik for reporting this issue.
Severity Rating:For an explanation of Severity Ratings, refer to Dell’s Vulnerability Disclosure Policy. RSA recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.
Legal Information:

Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this advisory, contact RSA Customer Support. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, Dell Technologies, distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information.

 

RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement.

 

In no event shall RSA, its affiliates or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or its suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.

Labels (1)
Labels:
  • Security Advisories

Tags (24)
  • Advisory
  • Auth Agent
  • Authentication Agent
  • CVE
  • emc security alert
  • PAM
  • pam 8.0
  • pam 8.1
  • pam 8.1.1
  • Product Communication
  • Product Notification
  • RSA SecurID
  • RSA SecurID Access
  • RSA Security Advisory
  • RSA Security Alert
  • SecurID
  • SecurID Access
  • SecurID Suite
  • Security Advisory
  • Security Alert
  • Security Announcement
  • Security Communication
  • Security Notification
  • Vulnerability
0 Likes
Was this article helpful? Yes No
Share
No ratings
Version history
Last update:
‎2020-07-22 06:03 AM
Updated by:
Employee RSA_PLM_Team
Contributors
  • RSA_PLM_Team
    RSA_PLM_Team

Related Content

Article Dashboard
  • Article History
Powered by Khoros
  • Blog
  • Events
  • Discussions
  • Idea Exchange
  • Knowledge Base
  • Case Portal
  • Community Support
  • Product Life Cycle
  • Support Information
  • Customer Success
  • About the Community
  • Terms & Conditions
  • Privacy Statement
  • Provide Feedback
  • Employee Login
© 2022 RSA Security LLC or its affiliates. All rights reserved.