Security Bulletin: IBM Tivoli Access Manager - token authentication RSA SecurID library uses weak cryptography (CVE-2013-0941)

Vulnerability Details

CVE-2013-0941

DESCRIPTION:
The WebSEAL component of TAM supports token authentication through integration with the RSA SecurId token authentication product. To support this integration, TAM includes an authentication module, commonly referred to as a "CDAS" module that includes a library provided by RSA. This library provides the client components of the RSA Authentication API that communicate with the RSA authentication server.

An updated library has been provided by RSA, which is included in the patched versions of IBM Tivoli Access Manager for e-business (TAM). After applying the patch, customers must remove existing node secret files from affected WebSEAL systems and regenerate them.

The attack requires administrative access to the file system of the WebSEAL server, and specialized knowledge and techniques to manipulate the file. An exploit would not impact accessibility of system resources, but it could affect the confidentiality of information and the integrity of some of the data used in the communications between the TAM WebSEAL system and the RSA authentication server.

CVE ID:
CVE-2013-0941

CVSS:
CVSS Base Score: 3.6
CVSS Temporal Score: See  https://exchange.xforce.ibmcloud.com/vulnerabilities/84319
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:N)