CVE-2016-8217

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

EMC RSA BSAFE Crypto-J versions prior to 6.2.2 has a PKCS#12 Timing Attack Vulnerability. A possible timing attack could be carried out by modifying a PKCS#12 file that has an integrity MAC for which the password is not known. An attacker could then feed the modified PKCS#12 file to the toolkit and guess the current MAC one byte at a time. This is possible because Crypto-J uses a non-constant-time method to compare the stored MAC with the calculated MAC. This vulnerability is similar to the issue described in CVE-2015-2601.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	RSA BSAFE Crypto-J RSA BSAFE Crypto-J versions prior to 6.2.2	RSA BSAFE Crypto-J RSA BSAFE Crypto-J versions prior to 6.2.2

References

http://www.securityfocus.com/archive/1/540066/30/0/threadedMailing List, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/95831Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037732Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/540066/30/0/threadedMailing List, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/95831Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037732Third Party Advisory, VDB Entry

Timeline

Published: Feb 3, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-82189.8An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete CVE-2016-82196.5An issue was discovered in Cloud Foundry Foundation cf-release versions prior to 250 and CAPI-release versions prior to 1.12.0. A user with CVE-2016-82207.5Pivotal Gemfire for PCF, versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0, contain an information disclosure vulnerability. The ap CVE-2016-82217.0Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded i CVE-2016-82224.4A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows CVE-2016-82237.8During an internal security review, Lenovo identified a local privilege escalation vulnerability in Lenovo System Interface Foundation softw CVE-2016-82244.4A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a sy CVE-2016-82257.8Unquoted service path vulnerability in Lenovo Edge and Lenovo Slim USB Keyboard Driver versions earlier than 1.21 allows local users to exec CVE-2016-82264.9The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure.CVE-2016-82277.8Privilege escalation vulnerability in Lenovo Transition application used in Lenovo Yoga, Flex and Miix systems running Windows allows local CVE-2016-82287.8In Lenovo Service Bridge before version 4, a user with local privileges on a system could execute code with administrative privileges.CVE-2016-82298.8A cross-site request forgery vulnerability in Lenovo Service Bridge before version 4 could be exploited by an attacker with access to the DH