| |
Vulnerability CVE-2010-3321
Published: 2010-10-07 Modified: 2012-02-13
| Description: |
RSA Authentication Client 2.0.x, 3.0, and 3.5.x before 3.5.3 does not properly handle a SENSITIVE or NON-EXTRACTABLE tag on a secret key object that is stored on a SecurID 800 authenticator, which allows local users to bypass intended access restrictions and read keys via unspecified PKCS#11 API requests. |
See advisories in our WLB2 database: | Topic | Author | Date |
Low |
| Graham Steele | 09.10.2010 |
Type:
CWE-264 (Permissions, Privileges, and Access Controls)
CVSS2 => (AV:L/AC:M/Au:S/C:P/I:N/A:N)
| CVSS Base Score |
Impact Subscore |
Exploitability Subscore |
1.5/10 |
2.9/10 |
2.7/10 |
| Exploit range |
Attack complexity |
Authentication |
Local |
Medium |
Single time |
| Confidentiality impact |
Integrity impact |
Availability impact |
Partial |
None |
None |
References: |
http://www.securityfocus.com/archive/1/514153/100/0/threaded
http://www.securityfocus.com/bid/43795
|
|
|
Copyright 2024, cxsecurity.com
|
|
|
