Description
RSA Adaptive Authentication (On-Premise) 6.0.2.1 through 7.1 P3, when using device binding in a Challenge SOAP call or using the RSA Adaptive Authentication Integration Adapters with Out-of-Band Phone (Authentify) functionality, conducts permanent device binding even when authentication fails, which allows remote attackers to bypass authentication.
References
- 1031297 vdb-entry
- 20141202 ESA-2014-160: RSA Adaptive Authentication (On-Premise) Authentication Bypass Vulnerability mailing-list
- 71423 vdb-entry
- rsa-adaptive-cve20144631-sec-bypass(99086) vdb-entry