bugtraq - [CAID 35754]: CA Host-Based Intrusion Prevention System (CA HIPS) Server Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 19 Oct 2007 09:49:11 -0400
From: "Williams, James K" <James.Williams@...com>
To: <bugtraq@...urityfocus.com>
Subject: [CAID 35754]: CA Host-Based Intrusion Prevention System (CA HIPS) Server Vulnerability

Title: [CAID 35754]: CA Host-Based Intrusion Prevention System 
(CA HIPS) Server Vulnerability

CA Vuln ID (CAID): 35754

CA Advisory Date: 2007-10-18

Reported By: David Maciejak

Impact: A remote attacker can take unauthorized administrative 
action.

Summary: CA Host-Based Intrusion Prevention System (CA HIPS) 
contains a vulnerability in the Server installation that can allow 
a remote attacker to take unauthorized administrative action. The 
vulnerability, CVE-2007-5472, occurs due to raw request data being 
displayed in the log when viewed by a browser. Note: The client 
installation is not vulnerable.

Mitigating Factors: The client installation is not vulnerable.

Severity: CA has given these vulnerabilities a maximum risk rating 
of Medium.

Affected Products:
CA Host-Based Intrusion Prevention System (CA HIPS) r8

Affected Platforms:
Windows

Status and Recommendation:
CA has issued the following patch to address the vulnerabilities.
CA Host-Based Intrusion Prevention System (CA HIPS) r8: QO91494

How to determine if you are affected:
1. Log in to the HIPS Administration Console.
2. Scroll down to the end of the Main page.
3. Press the "About" link on the right bottom side of the page.
4. Check the version. If the version is less than 8.0.0.93, the 
   installation is vulnerable.

Workaround: None

References (URLs may wrap):
CA SupportConnect:
http://supportconnect.ca.com/
Security Notice for CA Host-Based Intrusion Prevention System 
(CA HIPS) Server
http://supportconnectw.ca.com/public/cahips/infodocs/cahips-secnotice.asp
Solution Document Reference APARs:
QO91494
CA Security Advisor posting:
CA Host-Based Intrusion Prevention System (CA HIPS) Server 
Vulnerability
http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=158327
CA Vuln ID (CAID): 35754
http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35754
Reported By: 
David Maciejak
CVE References:
CVE-2007-5472 - log content injection
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5472
OSVDB References: Pending
http://osvdb.org/

Changelog for this advisory:
v1.0 - Initial Release

Customers who require additional information should contact CA
Technical Support at http://supportconnect.ca.com.

For technical questions or comments related to this advisory, 
please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your
findings to vuln AT ca DOT com, or utilize our "Submit a 
Vulnerability" form. 
URL: http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx

Regards,
Ken Williams ; 0xE2941985
Director, CA Vulnerability Research

CA, 1 CA Plaza, Islandia, NY 11749

Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2007 CA. All rights reserved.