The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of RSA Authentication Manager

vulnerability alert CVE-2019-2024

Linux kernel: use after free via em28xx_dvb_fini

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area via em28xx_dvb_fini() of the Linux kernel, in order to trigger a denial of service, and possibly to run code.
Impacted products: Debian, Android OS, Linux, openSUSE Leap, RSA Authentication Manager, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: administrator access/rights, denial of service on server, denial of service on service.
Provenance: user shell.
Creation date: 27/03/2019.
Identifiers: CERTFR-2019-AVI-131, CVE-2019-2024, DLA-1799-1, DLA-1799-2, DSA-2019-093, openSUSE-SU-2019:1085-1, openSUSE-SU-2019:1193-1, SUSE-SU-2019:0765-1, SUSE-SU-2019:0767-1, SUSE-SU-2019:0801-1, SUSE-SU-2019:0828-1, SUSE-SU-2019:0901-1, VIGILANCE-VUL-28871.

Description of the vulnerability

An attacker can force the usage of a freed memory area via em28xx_dvb_fini() of the Linux kernel, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2019-8936

NTP.org: NULL pointer dereference via Authenticated Mode 6

Synthesis of the vulnerability

An attacker can force a NULL pointer to be dereferenced via Authenticated Mode 6 of NTP.org, in order to trigger a denial of service.
Impacted products: Fedora, FreeBSD, Meinberg NTP Server, Data ONTAP, NTP.org, openSUSE Leap, Solaris, pfSense, RSA Authentication Manager, Slackware, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: denial of service on service, denial of service on client.
Provenance: user account.
Creation date: 08/03/2019.
Identifiers: 3565, bulletinapr2019, CVE-2019-8936, DSA-2019-093, FEDORA-2019-694e3aa4e8, FEDORA-2019-f781d5c4c6, FreeBSD-SA-19:04.ntp, NTAP-20190503-0001, openSUSE-SU-2019:1143-1, openSUSE-SU-2019:1158-1, SSA:2019-067-01, SUSE-SU-2019:0775-1, SUSE-SU-2019:0777-1, SUSE-SU-2019:0789-1, SUSE-SU-2019:13991-1, SUSE-SU-2019:14004-1, VIGILANCE-VUL-28701.

Description of the vulnerability

An attacker can force a NULL pointer to be dereferenced via Authenticated Mode 6 of NTP.org, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2019-3711

RSA Authentication Manager: privilege escalation via Previous Domain Password

Synthesis of the vulnerability

An attacker can bypass restrictions via Previous Domain Password of RSA Authentication Manager, in order to escalate his privileges.
Impacted products: RSA Authentication Manager.
Severity: 1/4.
Consequences: privileged access/rights, user access/rights.
Provenance: privileged account.
Creation date: 04/03/2019.
Identifiers: CVE-2019-3711, DSA-2019-038, VIGILANCE-VUL-28641.

Description of the vulnerability

An attacker can bypass restrictions via Previous Domain Password of RSA Authentication Manager, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2019-8907

file: denial of service via do_core_note

Synthesis of the vulnerability

An attacker can trigger a fatal error via do_core_note() of file, in order to trigger a denial of service.
Impacted products: Debian, Fedora, openSUSE Leap, RSA Authentication Manager, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: denial of service on service, denial of service on client.
Provenance: document.
Creation date: 25/02/2019.
Identifiers: CVE-2019-8907, DLA-1698-1, DSA-2019-093, FEDORA-2019-15f5147b27, openSUSE-SU-2019:0345-1, openSUSE-SU-2019:1197-1, SSA:2019-054-01, SUSE-SU-2019:0571-1, SUSE-SU-2019:0839-1, USN-3911-1, VIGILANCE-VUL-28591.

Description of the vulnerability

An attacker can trigger a fatal error via do_core_note() of file, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2018-15782

RSA Authentication Manager: directory traversal via Quick Setup

Synthesis of the vulnerability

An attacker can traverse directories via Quick Setup of RSA Authentication Manager, in order to create a file outside the service root path.
Impacted products: RSA Authentication Manager.
Severity: 2/4.
Consequences: data reading.
Provenance: internet client.
Creation date: 07/01/2019.
Identifiers: CVE-2018-15782, DSA-2018-226, VIGILANCE-VUL-28172.

Description of the vulnerability

An attacker can traverse directories via Quick Setup of RSA Authentication Manager, in order to create a file outside the service root path.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2018-19985

Linux kernel: out-of-bounds memory reading via hso_probe

Synthesis of the vulnerability

An attacker can force a read at an invalid address via hso_probe() of the Linux kernel, in order to trigger a denial of service, or to obtain sensitive information.
Impacted products: Debian, Linux, openSUSE Leap, RSA Authentication Manager, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 1/4.
Consequences: data reading, denial of service on server, denial of service on service.
Provenance: user shell.
Creation date: 31/12/2018.
Identifiers: CERTFR-2019-AVI-038, CERTFR-2019-AVI-042, CERTFR-2019-AVI-051, CERTFR-2019-AVI-071, CERTFR-2019-AVI-114, CERTFR-2019-AVI-115, CERTFR-2019-AVI-233, CVE-2018-19985, DLA-1731-1, DLA-1731-2, DLA-1771-1, DSA-2019-062, openSUSE-SU-2019:0065-1, openSUSE-SU-2019:0140-1, SSA:2019-030-01, SUSE-SU-2019:0148-1, SUSE-SU-2019:0196-1, SUSE-SU-2019:0222-1, SUSE-SU-2019:0224-1, SUSE-SU-2019:0320-1, SUSE-SU-2019:0439-1, SUSE-SU-2019:0541-1, SUSE-SU-2019:1289-1, SUSE-SU-2019:13937-1, SUSE-SU-2019:13979-1, USN-3910-1, USN-3910-2, VIGILANCE-VUL-28137.

Description of the vulnerability

An attacker can force a read at an invalid address via hso_probe() of the Linux kernel, in order to trigger a denial of service, or to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2018-20169

Linux kernel: buffer overflow via usb_get_extra_descriptor

Synthesis of the vulnerability

An attacker can generate a buffer overflow via usb_get_extra_descriptor() of the Linux kernel, in order to trigger a denial of service, and possibly to run code.
Impacted products: Debian, Fedora, Linux, openSUSE Leap, RSA Authentication Manager, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: administrator access/rights, privileged access/rights, denial of service on server.
Provenance: physical access.
Creation date: 18/12/2018.
Identifiers: CERTFR-2019-AVI-038, CERTFR-2019-AVI-042, CERTFR-2019-AVI-044, CERTFR-2019-AVI-051, CERTFR-2019-AVI-071, CERTFR-2019-AVI-114, CERTFR-2019-AVI-233, CVE-2018-20169, DLA-1731-1, DLA-1731-2, DLA-1771-1, DSA-2019-062, FEDORA-2018-6e8c330d50, openSUSE-SU-2019:0065-1, openSUSE-SU-2019:0140-1, SSA:2019-030-01, SUSE-SU-2019:0148-1, SUSE-SU-2019:0196-1, SUSE-SU-2019:0222-1, SUSE-SU-2019:0224-1, SUSE-SU-2019:0320-1, SUSE-SU-2019:0439-1, SUSE-SU-2019:0541-1, SUSE-SU-2019:1289-1, SUSE-SU-2019:13937-1, SUSE-SU-2019:13979-1, USN-3879-1, USN-3879-2, VIGILANCE-VUL-28046.

Description of the vulnerability

An attacker can generate a buffer overflow via usb_get_extra_descriptor() of the Linux kernel, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2018-19824

Linux kernel: use after free via usb_audio_probe

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area via usb_audio_probe() of the Linux kernel, in order to trigger a denial of service, and possibly to run code.
Impacted products: Debian, Fedora, Linux, openSUSE Leap, RSA Authentication Manager, Slackware, SUSE Linux Enterprise Desktop, SLES, Synology DSM, Synology DS***, Synology RS***, Ubuntu.
Severity: 2/4.
Consequences: administrator access/rights, denial of service on server, denial of service on service.
Provenance: user shell.
Creation date: 04/12/2018.
Identifiers: CERTFR-2019-AVI-038, CERTFR-2019-AVI-042, CERTFR-2019-AVI-044, CERTFR-2019-AVI-051, CERTFR-2019-AVI-071, CERTFR-2019-AVI-114, CERTFR-2019-AVI-145, CERTFR-2019-AVI-233, CVE-2018-19824, DLA-1731-1, DLA-1731-2, DLA-1771-1, DSA-2019-062, FEDORA-2018-5904d0794d, FEDORA-2018-a0914af224, openSUSE-SU-2019:0065-1, openSUSE-SU-2019:0140-1, SSA:2019-030-01, SUSE-SU-2018:4069-1, SUSE-SU-2019:0148-1, SUSE-SU-2019:0222-1, SUSE-SU-2019:0224-1, SUSE-SU-2019:0320-1, SUSE-SU-2019:0439-1, SUSE-SU-2019:0541-1, SUSE-SU-2019:1289-1, SUSE-SU-2019:13937-1, SUSE-SU-2019:13979-1, USN-3879-1, USN-3879-2, USN-3930-1, USN-3930-2, USN-3931-1, USN-3931-2, USN-3933-1, USN-3933-2, VIGILANCE-VUL-27944.

Description of the vulnerability

An attacker can force the usage of a freed memory area via usb_audio_probe() of the Linux kernel, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2018-11073 CVE-2018-11074 CVE-2018-11075

RSA Authentication Manager: three vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of RSA Authentication Manager.
Impacted products: RSA Authentication Manager.
Severity: 2/4.
Consequences: client access/rights.
Provenance: document.
Number of vulnerabilities in this bulletin: 3.
Creation date: 21/09/2018.
Identifiers: CVE-2018-11073, CVE-2018-11074, CVE-2018-11075, DSA-2018-152, VIGILANCE-VUL-27282.

Description of the vulnerability

An attacker can use several vulnerabilities of RSA Authentication Manager.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2018-5391

Linux kernel: denial of service via FragmentSmack

Synthesis of the vulnerability

An attacker can generate a fatal error via FragmentSmack of the Linux kernel, in order to trigger a denial of service.
Impacted products: GAiA, SecurePlatform, CheckPoint Security Gateway, Cisco Aironet, IOS XE Cisco, Nexus by Cisco, Prime Collaboration Assurance, Prime Infrastructure, Cisco Router, Secure ACS, Cisco CUCM, Cisco UCS, Cisco Unified CCX, Cisco IP Phone, Cisco Wireless Controller, Debian, BIG-IP Hardware, TMOS, Junos Space, Linux, Windows 10, Windows 2008 R0, Windows 2008 R2, Windows 2012, Windows 2016, Windows 7, Windows 8, Windows RT, openSUSE Leap, Palo Alto Firewall PA***, PAN-OS, RHEL, RSA Authentication Manager, SUSE Linux Enterprise Desktop, SLES, Symantec Content Analysis, ProxySG by Symantec, Synology DSM, Ubuntu.
Severity: 2/4.
Consequences: denial of service on server, denial of service on service.
Provenance: internet client.
Creation date: 16/08/2018.
Identifiers: ADV180022, CERTFR-2018-AVI-390, CERTFR-2018-AVI-392, CERTFR-2018-AVI-419, CERTFR-2018-AVI-457, CERTFR-2018-AVI-478, CERTFR-2018-AVI-533, CERTFR-2019-AVI-233, CERTFR-2019-AVI-242, cisco-sa-20180824-linux-ip-fragment, CVE-2018-5391, DLA-1466-1, DLA-1529-1, DSA-2019-062, DSA-4272-1, FragmentSmack, JSA10917, K74374841, openSUSE-SU-2018:2404-1, openSUSE-SU-2018:2407-1, openSUSE-SU-2019:0274-1, PAN-SA-2018-0012, RHSA-2018:2785-01, RHSA-2018:2791-01, RHSA-2018:2846-01, RHSA-2018:2924-01, RHSA-2018:2925-01, RHSA-2018:2933-01, RHSA-2018:2948-01, RHSA-2018:3083-01, RHSA-2018:3096-01, RHSA-2018:3459-01, RHSA-2018:3540-01, RHSA-2018:3586-01, RHSA-2018:3590-01, sk134253, SUSE-SU-2018:2344-1, SUSE-SU-2018:2374-1, SUSE-SU-2018:2380-1, SUSE-SU-2018:2381-1, SUSE-SU-2018:2596-1, SUSE-SU-2019:0541-1, SUSE-SU-2019:1289-1, SYMSA1467, Synology-SA-18:44, USN-3740-1, USN-3740-2, USN-3741-1, USN-3741-2, USN-3741-3, USN-3742-1, USN-3742-2, USN-3742-3, VIGILANCE-VUL-27009, VU#641765.

Description of the vulnerability

An attacker can generate a fatal error via FragmentSmack of the Linux kernel, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about RSA Authentication Manager: