Vulnerability-Lookup

VAR-201404-0683

Vulnerability from variot - Updated: 2025-04-13 23:32

EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain. Successfully exploiting this issue allows attackers to create improper authenticated SSL connections, which will aid in further attacks. RSA BSAFE Micro Edition Suite (MES) 4.0.x versions prior to 4.0.5 and 3.2.x version prior to 3.2.6 are vulnerable. The toolkit helps developers achieve stable and secure application design. The vulnerability stems from the fact that the program does not properly validate the X.509 certificate chain. MES 4.0.5 and 3.2.6 are designed to address this issue by performing proper certificate validation.

Recommendation: RSA strongly recommends that customers on MES 4.0.x upgrade to MES 4.0.5 and customers on MES 3.2.x upgrade to MES 3.2.6 at the earliest opportunity.

Obtaining Downloads: To request your upgrade of the software, please call your local support telephone number (contact phone numbers are available at http://www.emc.com/support/rsa/contact/phone-numbers.htm) for most expedient service.

Obtaining Documentation: To obtain RSA documentation, log on to RSA SecurCare Online at https://knowledge.rsasecurity.com and click Products in the top navigation menu. Select the specific product whose documentation you want to obtain. Scroll to the section for the product version that you want and click the set link.

Severity Rating: For an explanation of Severity Ratings, refer to the Knowledge Base Article, \x93Security Advisories Severity Rating\x94 at https://knowledge.rsasecurity.com/scolcms/knowledge.aspx?solution=a46604. RSA recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.

Obtaining More Information: For more information about RSA products, visit the RSA web site at http://www.rsa.com.

Getting Support and Service: For customers with current maintenance contracts, contact your local RSA Customer Support center with any additional questions regarding this RSA SecurCare Note. For contact telephone numbers or e-mail addresses, log on to RSA SecurCare Online at https://knowledge.rsasecurity.com, click Help & Contact, and then click the Contact Us - Phone tab or the Contact Us - Email tab.

General Customer Support Information: http://www.emc.com/support/rsa/index.htm

RSA SecurCare Online: https://knowledge.rsasecurity.com

EOPS Policy: RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the link below for additional details. http://www.emc.com/support/rsa/eops/index.htm

SecurCare Online Security Advisories RSA, The Security Division of EMC, distributes SCOL Security Advisories in order to bring to the attention of users of the affected RSA products important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. RSA disclaim all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall RSA or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

About RSA SecurCare Notes & Security Advisories Subscription RSA SecurCare Notes & Security Advisories are targeted e-mail messages that RSA sends you based on the RSA product family you currently use. If you\x92d like to stop receiving RSA SecurCare Notes & Security Advisories, or if you\x92d like to change which RSA product family Notes & Security Advisories you currently receive, log on to RSA SecurCare Online at https://knowledge.rsasecurity.com/scolcms/help.aspx?_v=view3. Following the instructions on the page, remove the check mark next to the RSA product family whose Notes & Security Advisories you no longer want to receive. Click the Submit button to save your selection.

Sincerely, RSA Customer Support -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (Cygwin)

iEYEARECAAYFAlNIFhUACgkQtjd2rKp+ALwepgCgtGh+srqAWqf0NedDF8AfS13Y 7FwAnRbX6vxIBBd4KBRVlKfYdj0CgMR2 =eaax -----END PGP SIGNATURE-----

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201404-0683",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "bsafe micro-edition-suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "4.0.2"
      },
      {
        "model": "bsafe micro-edition-suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "3.2.2"
      },
      {
        "model": "bsafe micro-edition-suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "4.0.3"
      },
      {
        "model": "bsafe micro-edition-suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "4.0.1"
      },
      {
        "model": "bsafe micro-edition-suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "3.2.1"
      },
      {
        "model": "bsafe micro-edition-suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "3.2.5"
      },
      {
        "model": "bsafe micro-edition-suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "4.0.0"
      },
      {
        "model": "bsafe micro-edition-suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "3.2.3"
      },
      {
        "model": "bsafe micro-edition-suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "3.2.0"
      },
      {
        "model": "bsafe micro-edition-suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "3.2.4"
      },
      {
        "model": "bsafe micro-edition-suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "4.0.4"
      },
      {
        "model": "rsa bsafe",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "dell emc old emc",
        "version": "4.0.x"
      },
      {
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "(64)"
      },
      {
        "model": "rsa bsafe",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "dell emc old emc",
        "version": "micro edition suite 3.2.6"
      },
      {
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "(64)"
      },
      {
        "model": "ucosminexus primary server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "base"
      },
      {
        "model": "ucosminexus primary server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "base(64)"
      },
      {
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "none"
      },
      {
        "model": "ucosminexus developer",
        "scope": null,
        "trust": 0.8,
        "vendor": "hitachi",
        "version": null
      },
      {
        "model": "rsa bsafe",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "dell emc old emc",
        "version": "3.2.x"
      },
      {
        "model": "cosminexus http server",
        "scope": null,
        "trust": 0.8,
        "vendor": "hitachi",
        "version": null
      },
      {
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "none"
      },
      {
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "-r"
      },
      {
        "model": "rsa bsafe",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "dell emc old emc",
        "version": "micro edition suite 4.0.5"
      },
      {
        "model": "ucosminexus service architect",
        "scope": null,
        "trust": 0.8,
        "vendor": "hitachi",
        "version": null
      },
      {
        "model": "rsa bsafe",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "emc",
        "version": "3.2.3"
      },
      {
        "model": "rsa bsafe",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "emc",
        "version": "3.2.5"
      },
      {
        "model": "rsa bsafe",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "emc",
        "version": "3.2.4"
      },
      {
        "model": "rsa bsafe",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "emc",
        "version": "3.2.1"
      },
      {
        "model": "rsa bsafe",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "emc",
        "version": "4.0.3"
      },
      {
        "model": "rsa bsafe",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "emc",
        "version": "4.0.4"
      },
      {
        "model": "rsa bsafe",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "emc",
        "version": "3.2.0"
      },
      {
        "model": "rsa bsafe",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "emc",
        "version": "3.2.2"
      },
      {
        "model": "rsa bsafe",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "emc",
        "version": "4.0.1"
      },
      {
        "model": "rsa bsafe",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "emc",
        "version": "4.0.0"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002004"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-161"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0636"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:emc:rsa_bsafe",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:cosminexus_http_server",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:ucosminexus_application_server",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:ucosminexus_developer",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:ucosminexus_primary_server",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:ucosminexus_service_architect",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:ucosminexus_service_platform",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002004"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The vendor reported this issue.",
    "sources": [
      {
        "db": "BID",
        "id": "66791"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-0636",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2014-0636",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-68129",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2014-0636",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2014-0636",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201404-161",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-68129",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68129"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002004"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-161"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0636"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain. \nSuccessfully exploiting this issue allows attackers to create improper authenticated SSL connections, which will aid in further attacks. \nRSA BSAFE Micro Edition Suite (MES) 4.0.x versions prior to 4.0.5 and 3.2.x version prior to 3.2.6 are vulnerable. The toolkit helps developers achieve stable and secure application design. The vulnerability stems from the fact that the program does not properly validate the X.509 certificate chain. MES 4.0.5 and 3.2.6 are designed to address this issue by performing proper certificate validation. \n \nRecommendation:\nRSA strongly recommends that customers on MES 4.0.x upgrade to MES 4.0.5 and customers on MES 3.2.x upgrade to MES 3.2.6 at the earliest opportunity. \n \nObtaining Downloads: \nTo request your upgrade of the software, please call your local support telephone number (contact phone numbers are available at http://www.emc.com/support/rsa/contact/phone-numbers.htm) for most expedient service.   \n\nObtaining Documentation:\nTo obtain RSA documentation, log on to RSA SecurCare Online at https://knowledge.rsasecurity.com and click Products in the top navigation menu. Select the specific product whose documentation you want to obtain. Scroll to the section for the product version that you want and click the set link. \n\nSeverity Rating:\nFor an explanation of Severity Ratings, refer to the Knowledge Base Article, \\x93Security Advisories Severity Rating\\x94 at https://knowledge.rsasecurity.com/scolcms/knowledge.aspx?solution=a46604. RSA recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. \n\nObtaining More Information:\nFor more information about RSA products, visit the RSA web site at http://www.rsa.com. \n\nGetting Support and Service:\nFor customers with current maintenance contracts, contact your local RSA Customer Support center with any additional questions regarding this RSA SecurCare Note. For contact telephone numbers or e-mail addresses, log on to RSA SecurCare Online at https://knowledge.rsasecurity.com, click Help \u0026 Contact, and then click the Contact Us - Phone tab or the Contact Us - Email tab. \n\nGeneral Customer Support Information:\nhttp://www.emc.com/support/rsa/index.htm\n\nRSA SecurCare Online:\nhttps://knowledge.rsasecurity.com\n\nEOPS Policy:\nRSA has a defined End of Primary Support policy associated with all major versions. Please refer to the link below for additional details. \nhttp://www.emc.com/support/rsa/eops/index.htm\n\nSecurCare Online Security Advisories\nRSA, The Security Division of EMC, distributes SCOL Security Advisories in order to bring to the attention of users of the affected RSA products important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided \"as is\" without warranty of any kind. RSA disclaim all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall RSA or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. \n\nAbout RSA SecurCare Notes \u0026 Security Advisories Subscription\nRSA SecurCare Notes \u0026 Security Advisories are targeted e-mail messages that RSA sends you based on the RSA product family you currently use. If you\\x92d like to stop receiving RSA SecurCare Notes \u0026 Security Advisories, or if you\\x92d like to change which RSA product family Notes \u0026 Security Advisories you currently receive, log on to RSA SecurCare Online at https://knowledge.rsasecurity.com/scolcms/help.aspx?_v=view3. Following the instructions on the page, remove the check mark next to the RSA product family whose Notes \u0026 Security Advisories you no longer want to receive. Click the Submit button to save your selection. \n\nSincerely,\nRSA Customer Support\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.13 (Cygwin)\n\niEYEARECAAYFAlNIFhUACgkQtjd2rKp+ALwepgCgtGh+srqAWqf0NedDF8AfS13Y\n7FwAnRbX6vxIBBd4KBRVlKfYdj0CgMR2\n=eaax\n-----END PGP SIGNATURE-----\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0636"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002004"
      },
      {
        "db": "BID",
        "id": "66791"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68129"
      },
      {
        "db": "PACKETSTORM",
        "id": "126130"
      }
    ],
    "trust": 2.07
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-68129",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68129"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-0636",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "66791",
        "trust": 2.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002004",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-161",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "126130",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-68129",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68129"
      },
      {
        "db": "BID",
        "id": "66791"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002004"
      },
      {
        "db": "PACKETSTORM",
        "id": "126130"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-161"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0636"
      }
    ]
  },
  "id": "VAR-201404-0683",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68129"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2025-04-13T23:32:50.127000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "RSA BSAFE Micro Edition Suite",
        "trust": 0.8,
        "url": "http://japan.emc.com/security/rsa-bsafe/rsa-bsafe-micro-edtion-suite.htm"
      },
      {
        "title": "HS14-012",
        "trust": 0.8,
        "url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-012/index.html"
      },
      {
        "title": "HS14-012",
        "trust": 0.8,
        "url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-012/index.html"
      },
      {
        "title": "EMC RSA BSAFE Micro Edition Suite Fixes for encryption problem vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=172323"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002004"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-161"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-310",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68129"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002004"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0636"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/66791"
      },
      {
        "trust": 1.7,
        "url": "http://archives.neohapsis.com/archives/bugtraq/2014-04/0069.html"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0636"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0636"
      },
      {
        "trust": 0.8,
        "url": "http://archives.neohapsis.com/archives/bugtraq/2014-04/att-0069/esa-2014-019.txt"
      },
      {
        "trust": 0.1,
        "url": "http://www.emc.com/support/rsa/contact/phone-numbers.htm)"
      },
      {
        "trust": 0.1,
        "url": "https://knowledge.rsasecurity.com/scolcms/knowledge.aspx?solution=a46604."
      },
      {
        "trust": 0.1,
        "url": "http://www.emc.com/support/rsa/eops/index.htm"
      },
      {
        "trust": 0.1,
        "url": "http://www.rsa.com."
      },
      {
        "trust": 0.1,
        "url": "https://knowledge.rsasecurity.com/scolcms/help.aspx?_v=view3."
      },
      {
        "trust": 0.1,
        "url": "https://knowledge.rsasecurity.com"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0636"
      },
      {
        "trust": 0.1,
        "url": "http://www.emc.com/support/rsa/index.htm"
      },
      {
        "trust": 0.1,
        "url": "https://knowledge.rsasecurity.com,"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68129"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002004"
      },
      {
        "db": "PACKETSTORM",
        "id": "126130"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-161"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0636"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-68129"
      },
      {
        "db": "BID",
        "id": "66791"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002004"
      },
      {
        "db": "PACKETSTORM",
        "id": "126130"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-161"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0636"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-04-11T00:00:00",
        "db": "VULHUB",
        "id": "VHN-68129"
      },
      {
        "date": "2014-04-11T00:00:00",
        "db": "BID",
        "id": "66791"
      },
      {
        "date": "2014-04-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-002004"
      },
      {
        "date": "2014-04-11T20:22:22",
        "db": "PACKETSTORM",
        "id": "126130"
      },
      {
        "date": "2014-04-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201404-161"
      },
      {
        "date": "2014-04-11T19:55:04.307000",
        "db": "NVD",
        "id": "CVE-2014-0636"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-12-09T00:00:00",
        "db": "VULHUB",
        "id": "VHN-68129"
      },
      {
        "date": "2015-01-12T00:03:00",
        "db": "BID",
        "id": "66791"
      },
      {
        "date": "2014-05-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-002004"
      },
      {
        "date": "2021-12-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201404-161"
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2014-0636"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-161"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "EMC RSA BSAFE Micro Edition Suite In  SSL Vulnerability impersonating a server",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002004"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "encryption problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-161"
      }
    ],
    "trust": 0.6
  }
}

CVE-2014-0636 (GCVE-0-2014-0636)

Vulnerability from cvelistv5 – Published: 2014-04-11 19:00 – Updated: 2024-08-06 09:20

Summary

Severity

No CVSS data available.

CWE

Assigner

dell CNA under the mitre root

CNA scorecard C 70/100 over 522 records in the last 180 days details

References

2 references

URL	Tags
http://archives.neohapsis.com/archives/bugtraq/20…	mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/66791	vdb-entryx_refsource_BID

Date Public

2014-04-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:20:19.941Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20140411 ESA-2014-019: RSA BSAFE Micro Edition Suite Certificate Chain Processing Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2014-04/0069.html"
          },
          {
            "name": "66791",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/66791"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-04-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-11-14T14:57:00.000Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "name": "20140411 ESA-2014-019: RSA BSAFE Micro Edition Suite Certificate Chain Processing Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2014-04/0069.html"
        },
        {
          "name": "66791",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/66791"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security_alert@emc.com",
          "ID": "CVE-2014-0636",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20140411 ESA-2014-019: RSA BSAFE Micro Edition Suite Certificate Chain Processing Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2014-04/0069.html"
            },
            {
              "name": "66791",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/66791"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2014-0636",
    "datePublished": "2014-04-11T19:00:00.000Z",
    "dateReserved": "2014-01-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T09:20:19.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted