CVE-2019-3732: dell bsafe_crypto-c-micro-edition Covert Timing Channel

Vulnerability summary

CVE-2019-3732 is a high (CVSS 7.5) Covert Timing Channel vulnerability in dell bsafe_crypto-c-micro-edition. EPSS estimates a 1.42% chance of exploitation in the next 30 days, higher than 72.3% of scored vulnerabilities.

Timeline

1. 30-09-2019
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

RSA BSAFE Crypto-C Micro Edition, versions prior to 4.0.5.3 (in 4.0.x) and versions prior to 4.1.3.3 (in 4.1.x), and RSA Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) versions prior to 4.1.6.1 (in 4.1.x) and versions prior to 4.3.3 (4.2.x and 4.3.x) are vulnerable to an Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure.

• CWE-385Covert Timing ChannelCovert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
• CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.