CVE-2016-8217
Published: Feb 3, 2017
Modified: Aug 6, 2024
Description
EMC RSA BSAFE Crypto-J versions prior to 6.2.2 has a PKCS#12 Timing Attack Vulnerability. A possible timing attack could be carried out by modifying a PKCS#12 file that has an integrity MAC for which the password is not known. An attacker could then feed the modified PKCS#12 file to the toolkit and guess the current MAC one byte at a time. This is possible because Crypto-J uses a non-constant-time method to compare the stored MAC with the calculated MAC. This vulnerability is similar to the issue described in CVE-2015-2601.
| Vendor | Product | Versions |
|---|---|---|
n/a | RSA BSAFE Crypto-J RSA BSAFE Crypto-J versions prior to 6.2.2 | affected RSA BSAFE Crypto-J RSA BSAFE Crypto-J versions prior to 6.2.2 |
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now