Medium severity · published Aug 31, 2018
CVE-2018-11055
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before Release ('Heap Inspection')…
5.5
CVSS
0.4%
EPSS
No
On KEV
Description
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before Release ('Heap Inspection') vulnerability. Decoded PKCS #12 data in heap memory is not zeroized by MES before releasing the memory internally and a malicious local user could gain access to the unauthorized data by doing heap inspection.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Application Testing Suite · Oracle
13.3.0.1 · source: NVD
BS
Bsafe · Dell
4.0.0 before 4.0.11; 4.1.0 before 4.1.6.1 · source: NVD
CA
Communications Analytics · Oracle
12.1.1 · source: NVD
CI
Communications IP Service Activator · Oracle
7.3.0; 7.4.0 · source: NVD
CR
Core Rdbms · Oracle
11.2.0.4; 12.1.0.2; 12.2.0.1; 18c; 19c · source: NVD
EM
Enterprise Manager Ops Center · Oracle
12.3.3; 12.4.0 · source: NVD
GA
Goldengate Application Adapters · Oracle
12.3.2.1.0 · source: NVD
JE
JD Edwards Enterpriseone Tools · Oracle
9.2 · source: NVD
RU
Real User Experience Insight · Oracle
13.1.2.1; 13.2.3.1; 13.3.1.0 · source: NVD
RP
Retail Predictive Application Server · Oracle
15.0.3; 16.0.3.0 · source: NVD
SS
Security Service · Oracle
11.1.1.9.0; 12.1.3.0.0; 12.2.1.3.0 · source: NVD
TI
Timesten In-memory Database · Oracle
before 18.1.4.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11055
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11055
Mailing List
http://seclists.org/fulldisclosure/2018/Aug/46
Patch
https://www.oracle.com/security-alerts/cpuapr2020.html
Patch
https://www.oracle.com/security-alerts/cpujan2020.html
Patch
https://www.oracle.com/security-alerts/cpujul2020.html
Patch
https://www.oracle.com/security-alerts/cpuoct2020.html
Patch
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
More from Bsafe
9.8
CVE-2018-11058
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior to 4.0.5.3 (in 4.0.x) contain…
9.8
CVE-2015-0537
Integer underflow in the base64-decoding implementation in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-C Micro Edition…
7.5
CVE-2018-15769
RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key management error issue
7.5
CVE-2018-11054
RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability
7.5
CVE-2016-0923
The client in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a signature-algorithm list transmitted to a…