CVE-2013-6078
First published: Tue Jun 17 2014(Updated: )
The default configuration of EMC RSA BSAFE Toolkits and RSA Data Protection Manager (DPM) 20130918 uses the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by leveraging unspecified "security concerns," aka the ESA-2013-068 issue. NOTE: this issue has been SPLIT from CVE-2007-6755 because the vendor announcement did not state a specific technical rationale for a change in the algorithm; thus, CVE cannot reach a conclusion that a CVE-2007-6755 concern was the reason, or one of the reasons, for this change.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| EMC RSA BSAFE Toolkits | ||
| EMC RSA Data Protection Manager | =20130918 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/
- http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html
- http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/
- http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect
Frequently Asked Questions
What is the severity of CVE-2013-6078?
CVE-2013-6078 has a high severity rating, as it can significantly compromise cryptographic security.
How do I fix CVE-2013-6078?
To fix CVE-2013-6078, update the EMC RSA BSAFE Toolkits and RSA Data Protection Manager to the latest version that does not use the Dual_EC_DRBG algorithm.
What systems are affected by CVE-2013-6078?
CVE-2013-6078 affects the default configuration of EMC RSA BSAFE Toolkits and RSA Data Protection Manager version 20130918.
What impact does CVE-2013-6078 have on security?
CVE-2013-6078 allows attackers to potentially predict cryptographic keys, thereby compromising the confidentiality and integrity of protected data.
Is CVE-2013-6078 related to the NSA?
Yes, CVE-2013-6078 has been linked to concerns about NSA influence on cryptographic standards, particularly the use of Dual_EC_DRBG.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/emc
- canonical/emc rsa bsafe toolkits
- canonical/emc rsa data protection manager
- version/emc rsa data protection manager/20130918