SB2017071303 - Two vulnerabilities in RSA Authentication Manager

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Denial of service (CVE-ID: CVE-2017-8006)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to improper control of interaction frequency. A remote attacker with knowledge of the target user's Self-Service Console credentials can connect to the Self-Service Console and conduct a brute force PIN guessing attack to determine the target user's PIN and reset the PIN, causing the system to crash.

Successful exploitation of the vulnerability results in denial of service.

2) Cross-site scripting (CVE-ID: CVE-2017-8000)

The disclosed vulnerability allows a remote attacker with administrator privileges perform cross-site scripting (XSS) attacks.

The vulnerability is caused by incorrect filtration of input data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim’s browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

Install update from vendor's website.

References

• http://seclists.org/fulldisclosure/2017/Jul/23
• http://seclists.org/fulldisclosure/2017/Jul/25