CVE-2016-0887: Infoleak
EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition (CCME) 4.0.x and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2.1, RSA BSAFE SSL-J before 6.2.1, and RSA BSAFE SSL-C before 2.8.9 allow remote attackers to discover a private-key prime by conducting a Lenstra side-channel attack that leverages an application's failure to detect an RSA signature failure during a TLS session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0887?
CVE-2016-0887 is classified as high severity due to its potential to allow remote attackers to discover a private-key prime.
How do I fix CVE-2016-0887?
To fix CVE-2016-0887, upgrade to the updated versions of the affected software, specifically RSA BSAFE Micro Edition Suite 4.1.5 or later, RSA BSAFE Crypto-C Micro Edition 4.1.3 or later, RSA BSAFE Crypto-J 6.2.1 or later, or RSA BSAFE SSL-C 2.8.9 or later.
Which products are affected by CVE-2016-0887?
CVE-2016-0887 affects EMC RSA BSAFE Micro Edition Suite 4.0.x and 4.1.x versions prior to 4.1.5, RSA BSAFE Crypto-C Micro Edition 4.0.x and 4.1.x versions before 4.1.3, along with older versions of RSA BSAFE Crypto-J, SSL-J, and SSL-C.
What types of attacks can exploit CVE-2016-0887?
CVE-2016-0887 can be exploited through remote attacks that involve mathematical techniques to discover elements of a private key.
What are the symptoms of an exploitation of CVE-2016-0887?
Symptoms of exploitation of CVE-2016-0887 may include unusual access patterns or compromised cryptographic functionality within applications using the affected BSAFE products.