CVE-2015-0534 : EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2, RSA BS

EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2, RSA BSAFE SSL-J before 6.2, and RSA BSAFE SSL-C 2.8.9 and earlier do not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, a similar issue to CVE-2014-8275.

Published 2015-08-20 10:59:01

Updated 2021-12-14 16:09:25

Source Dell

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2015-0534

Probability of exploitation activity in the next 30 days: 0.29%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 65 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2015-0534

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2015-0534

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-0534

http://seclists.org/bugtraq/2015/Aug/84

Bugtraq: ESA-2015-081: RSA BSAFE® Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Multiple Vulnerabilities
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1033297

RSA BSAFE SSL-J Lets Remote Users Bypass Fingerprint Based Certificate Restrictions on the Target System - SecurityTracker
Third Party Advisory;VDB Entry
http://www.securitytracker.com/id/1033298

RSA BSAFE Crypto-J Lets Remote Users Bypass Fingerprint Based Certificate Restrictions on the Target System - SecurityTracker
Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/76377

Multiple EMC RSA Products ESA-2015-081 Multiple Security Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url

Products affected by CVE-2015-0534

Dell » Bsafe Ssl-j
Versions before (<) 6.2
cpe:2.3:a:dell:bsafe_ssl-j:*:*:*:*:*:*:*:*
Matching versions
Dell » Bsafe » Micro Edition Suite Edition
Versions from including (>=) 4.1.0 and before (<) 4.1.3
cpe:2.3:a:dell:bsafe:*:*:*:*:micro_edition_suite:*:*:*
Matching versions
Dell » Bsafe » Micro Edition Suite Edition
Versions from including (>=) 4.0.0 and before (<) 4.0.8
cpe:2.3:a:dell:bsafe:*:*:*:*:micro_edition_suite:*:*:*
Matching versions
Dell » Bsafe Ssl-c
Versions up to, including, (<=) 2.8.9
cpe:2.3:a:dell:bsafe_ssl-c:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2015-0534

Exploit prediction scoring system (EPSS) score for CVE-2015-0534

CVSS scores for CVE-2015-0534

CWE ids for CVE-2015-0534

References for CVE-2015-0534

Products affected by CVE-2015-0534