CVE-2018-1232

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow which may occur when handling certain malicious web cookies that have invalid formats. The attacker could exploit this vulnerability to crash the authentication agent and cause a denial-of-service situation.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Dell EMC	RSA Authentication Agent for Web for IIS, RSA Authentication Agent for Web for Apache Web Server	version 8.0.1 and earlier

References

http://seclists.org/fulldisclosure/2018/Mar/60Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1040577Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Mar/60Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1040577Third Party Advisory, VDB Entry

Timeline

Published: Mar 30, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-123207.8There is a use after free in radare2 2.6.0 in r_anal_bb_free() in libr/anal/bb.c via a crafted Java binary file.CVE-2018-123217.8There is a heap out of bounds read in radare2 2.6.0 in java_switch_op() in libr/anal/p/anal_java.c via a crafted Java binary file.CVE-2018-123225.5There is a heap out of bounds read in radare2 2.6.0 in _6502_op() in libr/anal/p/anal_6502.c via a crafted iNES ROM binary file.CVE-2018-123236.8An issue was discovered on Momentum Axel 720P 5.1.8 devices. A password of EHLGVG is hard-coded for the root and admin accounts, which makes CVE-2018-123268.4Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to high CVE-2018-123279.8Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher pri CVE-2018-123295.9Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows a local attacker to duplicate an authentication factor via clo CVE-2018-12336.1RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulnera CVE-2018-123308.1Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys v CVE-2018-123317.4Authentication Bypass by Spoofing vulnerability in ECOS System Management Appliance (aka SMA) 5.2.68 allows a man-in-the-middle attacker to CVE-2018-123324.2Incomplete Cleanup vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption ke CVE-2018-123338.1Insufficient Verification of Data Authenticity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to manipulate secu