Medium severity · published Apr 12, 2016
CVE-2016-0887
EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition (CCME) 4.0.x and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2.1, RSA…
5.9
CVSS
3.5%
EPSS
No
On KEV
Description
EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition (CCME) 4.0.x and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2.1, RSA BSAFE SSL-J before 6.2.1, and RSA BSAFE SSL-C before 2.8.9 allow remote attackers to discover a private-key prime by conducting a Lenstra side-channel attack that leverages an application's failure to detect an RSA signature failure during a TLS session.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Bsafe Crypto-c-micro-edition · Dell
4.0 through 4.0.5.3; 4.1 through 4.1.2 · source: NVD
BC
Bsafe Crypto-j · Dell
before 6.2.1 · source: NVD
BM
Bsafe Micro-edition-suite · Dell
4.0.0 through 4.0.11; 4.1.0 before 4.1.5 · source: NVD
BS
Bsafe Ssl-c · Dell
before 2.8.9 · source: NVD
BS
Bsafe Ssl-j · Dell
before 6.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-0887
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-0887
Third Party Advisory
http://packetstormsecurity.com/files/136656/RSA-BSAFE-Lenstras-Attack.html
Mailing List
http://seclists.org/bugtraq/2016/Apr/66
Third Party Advisory
http://www.securityfocus.com/archive/1/538055/100/0/threaded
Third Party Advisory
http://www.securitytracker.com/id/1035515
Third Party Advisory
http://www.securitytracker.com/id/1035516
Third Party Advisory
http://www.securitytracker.com/id/1035517
More from Bsafe Crypto-c-micro-edition
9.8
CVE-2020-29504
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Missing Required Cryptographic Step Vulnerability
9.8
CVE-2020-35169
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Input Validation Vulnerability
9.8
CVE-2020-35168
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability
9.8
CVE-2020-35167
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability
9.8
CVE-2020-35166
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability