Pierluigi Paganini December 04, 2017

Two different critical vulnerabilities were found in the RSA Authentication SDK (software development kit), patch them asap.

The first bug, tracked as  CVE-2017-14377, is authentication bypass that affects the RSA Authentication Agent for Web for Apache Web Server. The flaw could be exploited by a remote unauthenticated user by sending a crafted packet that triggers a validation error, in this way it can gain access to resources on the target.

“Due to an improper input validation flaw in RSA Authentication Agent for Web for Apache Web Server, a remote malicious user can potentially bypass user authentication and gain unauthorized access to resources protected by the agent. The privilege level of an unauthorized user who gains access depends on the authorization policy set by the underlying application that is using the agent.” reads the security advisory.
This vulnerability is only present when the RSA Authentication Agent for Web for Apache Web Server is configured to use the TCP protocol to communicate with the RSA Authentication Manager server. UDP implementation, which is the default configuration, is not vulnerable.  Please refer to the RSA Authentication Agent 8.x for Web for Apache Web Server Installation and Configuration Guide for configuration details.”

It is possible to mitigate the issue by configuring the authentication agent to use UDP, RSA has already released a patch at the following address:

https://community.rsa.com/community/products/securid/authentication-agent-web-apache

The second critical vulnerability tracked as CVE-2017-14378 affects the RSA Auth Agent SDK for C, this means that any other systems developed with the SDK would inherit it.  The vulnerability doesn’t affect the Java version of the SDK.

The versions 8.5 and 8.7 of the RSA Authentication Agent SDK had an error handling flaw affecting TCP asynchronous mode implementations that could be exploited by an attacker to bypass the authentication in certain limited implementations.

“A security vulnerability in RSA Authentication Agent API/SDK for C versions 8.5 and 8.6 could potentially lead to authentication bypass in certain limited implementations.”

“RSA Authentication Agent API/SDK 8.5/8.6 for C has an error handling flaw that could lead to authentication bypass in certain limited implementations. This issue will occur when the API/SDK is used in TCP asynchronous mode and return codes from the API/SDK are not handled properly by the application.” reads the security advisory.

“Implementations handling the API/SDK return codes appropriately (per coding guidelines documented in the  RSA Authentication Agent API for C Developer’s Guide) are not vulnerable.”

The patch for the C version of the SDK is available at the following URL:

https://community.rsa.com/docs/DOC-40601#agents

Pierluigi Paganini

(Security Affairs – RSA, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]