// For flags

CVE-2016-8217

RSA BSAFE Crypto-J Cryptography Failure

Severity Score

3.7
*CVSS v3.1

Exploit Likelihood

< 1%
*EPSS

Affected Versions

1
*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

EMC RSA BSAFE Crypto-J versions prior to 6.2.2 has a PKCS#12 Timing Attack Vulnerability. A possible timing attack could be carried out by modifying a PKCS#12 file that has an integrity MAC for which the password is not known. An attacker could then feed the modified PKCS#12 file to the toolkit and guess the current MAC one byte at a time. This is possible because Crypto-J uses a non-constant-time method to compare the stored MAC with the calculated MAC. This vulnerability is similar to the issue described in CVE-2015-2601.

EMC RSA BSAFE Crypto-J en versiones anteriores a 6.2.2 tiene una vulnerabilidad de ataque de sincronización PKCS#12. Un posible ataque de sincronización podría llevarse a cabo modificando un archivo PKCS#12 que tiene un MAC de integridad para el que no se conoce la contraseña. Un atacante podría entonces alimentar el archivo PKCS#12 modificado al toolkit y adivinar el MAC actual de un byte a la vez. Esto es posible porque Crypto-J utiliza un método de tiempo no constante para comparar el MAC almacenado con el MAC calculado. Esta vulnerabilidad es similar al problema descrito en CVE-2015-2601.

RSA BSAFE Crypto-J versions prior to 6.2.2 suffer from improper OCSP validation and PKCS#12 timing attack vulnerabilities.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2016-09-13 CVE Reserved
  • 2017-01-28 CVE Published
  • 2024-08-06 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (3)
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions (1)