CVE-2020-35169: Dell BSAFE Crypto Input Validation Flaw

CVE-2020-35169 Overview

Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Input Validation Vulnerability. This cryptographic library flaw affects multiple downstream products including Oracle Database, Oracle HTTP Server, Oracle Security Service, and Oracle WebLogic Server Proxy Plug-in, significantly expanding the potential attack surface across enterprise environments.

Critical Impact

This improper input validation vulnerability in widely-deployed cryptographic libraries enables remote attackers to potentially compromise confidentiality, integrity, and availability of affected systems without authentication or user interaction.

Affected Products

• Dell BSAFE Crypto-C Micro Edition (versions before 4.1.5)
• Dell BSAFE Micro Edition Suite (versions before 4.5.2)
• Oracle Database (versions 12.1.0.2, 19c, 21c Enterprise Edition)
• Oracle HTTP Server (versions 12.2.1.3.0, 12.2.1.4.0)
• Oracle Security Service (versions 12.2.1.3.0, 12.2.1.4.0)
• Oracle WebLogic Server Proxy Plug-in (versions 12.2.1.3.0, 12.2.1.4.0)

Discovery Timeline

• 2022-07-11 - CVE CVE-2020-35169 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-35169

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) combined with improper verification of cryptographic signatures (CWE-347) within the Dell BSAFE cryptographic libraries. The flaw allows attackers to bypass security controls by providing specially crafted input that is not properly validated before being processed by cryptographic operations.

The vulnerability is exploitable remotely over the network without requiring any privileges or user interaction. When successfully exploited, an attacker can achieve complete compromise of the affected system's confidentiality, integrity, and availability. The widespread use of Dell BSAFE libraries in Oracle enterprise products significantly amplifies the risk, as these components are commonly deployed in critical business infrastructure.

Root Cause

The root cause of CVE-2020-35169 lies in insufficient input validation within the Dell BSAFE cryptographic library's signature verification routines. When processing cryptographic operations, the library fails to adequately validate input parameters, allowing malformed or malicious data to be processed. This improper validation can lead to unexpected behavior during cryptographic signature verification, potentially allowing attackers to forge signatures or bypass authentication mechanisms.

Attack Vector

The attack vector for this vulnerability is network-based, allowing remote exploitation. An attacker can target any application or service that relies on the vulnerable Dell BSAFE libraries for cryptographic operations. The attack requires no authentication and no user interaction, making it particularly dangerous in internet-facing deployments.

Attack scenarios include:

• Submitting maliciously crafted data to applications using vulnerable BSAFE libraries for signature verification
• Exploiting SSL/TLS handshake processes in Oracle HTTP Server deployments
• Targeting authentication mechanisms in Oracle Database Enterprise Edition installations
• Compromising WebLogic Server deployments through the vulnerable proxy plug-in

The vulnerability mechanism involves the cryptographic library's failure to properly validate input before performing signature verification operations. When malformed input is processed, the library may incorrectly verify invalid signatures or fail in a way that bypasses security controls. For detailed technical information, refer to the Dell Security Advisory DSA-2020-286.

Detection Methods for CVE-2020-35169

Indicators of Compromise

• Unusual cryptographic operation failures or exceptions in application logs
• Unexpected authentication successes with malformed credentials
• Anomalous network traffic patterns targeting SSL/TLS endpoints
• Application crashes or unexpected behavior in services using BSAFE libraries

Detection Strategies

• Implement application-level logging to capture cryptographic operation anomalies
• Deploy network intrusion detection systems (IDS) to monitor for exploitation attempts against SSL/TLS services
• Use software composition analysis (SCA) tools to identify systems running vulnerable BSAFE library versions
• Monitor Oracle Database, HTTP Server, and WebLogic deployments for unusual authentication patterns

Monitoring Recommendations

• Enable verbose logging for applications utilizing Dell BSAFE cryptographic libraries
• Monitor authentication systems for signature verification failures or anomalies
• Implement real-time alerting for cryptographic operation exceptions
• Track SSL/TLS handshake failures and certificate validation errors across the infrastructure

How to Mitigate CVE-2020-35169

Immediate Actions Required

• Inventory all systems using Dell BSAFE Crypto-C Micro Edition and BSAFE Micro Edition Suite
• Prioritize patching for internet-facing systems and critical infrastructure components
• Review Oracle product deployments for affected versions of Database, HTTP Server, Security Service, and WebLogic Server Proxy Plug-in
• Implement network segmentation to limit exposure of vulnerable systems until patches can be applied

Patch Information

Dell has released patched versions addressing this vulnerability:

• Upgrade Dell BSAFE Crypto-C Micro Edition to version 4.1.5 or later
• Upgrade Dell BSAFE Micro Edition Suite to version 4.5.2 or later

For Oracle products, apply the patches referenced in the Oracle July 2022 Critical Patch Update. Consult the Dell Security Advisory DSA-2020-286 for complete patching guidance.

Workarounds

• Implement network-level access controls to restrict access to services using vulnerable libraries
• Deploy web application firewalls (WAF) with rules to detect and block potential exploitation attempts
• Enable additional authentication layers for critical systems while awaiting patch deployment
• Consider temporary service isolation for non-critical systems running vulnerable versions

# Configuration example
# Verify Dell BSAFE library version on affected systems
# Check for Oracle product versions in deployment
strings /path/to/bsafe/library | grep -i "version"

# Review Oracle HTTP Server version
$ORACLE_HOME/ohs/bin/httpd -v

# Check Oracle WebLogic Server version
java -cp $WL_HOME/server/lib/weblogic.jar weblogic.version