full-disclosure - [FD] CA20161109-02: Security Notice for CA Service Desk Manager

Open Source and information security mailing list archives

Date: Thu, 10 Nov 2016 00:27:07 +0000
From: "Williams, Ken" <Ken.Williams@...com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] CA20161109-02: Security Notice for CA Service Desk Manager

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

CA20161109-02: Security Notice for CA Service Desk Manager

Issued: November 09, 2016

CA Technologies Support is alerting customers to a vulnerability in CA 
Service Desk Manager (formerly CA Service Desk).  A reflected cross site 
scripting vulnerability, CVE-2016-9148, exists in the QBE.EQ.REF_NUM 
parameter of the SDM web interface.  A remote attacker, who can trick a 
user into clicking on or visiting a specially crafted link, could 
potentially execute arbitrary code on the targeted user's system.  CA 
Technologies has assigned a Medium risk rating to this vulnerability.  
A solution is available.

Risk Rating

Medium

Platform(s)

All

Affected Products

CA Service Desk Manager 12.9, 14.1

How to determine if the installation is affected

Check the web.cfg file for the existence of the solution detailed in KB 
article TEC1774903.

Solution 

Implement the solution detailed in KB article TEC1774903.

Workaround

None

References

CVE-2016-9148 - SDM QBE.EQ.REF_NUM Reflected XSS Vulnerability

Acknowledgement

CVE-2016-9148 - Jerold Hoong

Change History

Version 1.0:  Initial Release, 2016-11-09

If additional information is required, please contact CA Technologies 
Support at https://support.ca.com/

If you discover a vulnerability in CA Technologies products, please report 
your findings to the CA Technologies Product Vulnerability Response Team 
at vuln <AT> ca.com

CA Technologies Security Notices can be found at https://support.ca.com/
CA Product Vulnerability Response Team PGP Key:
https://www.ca.com/us/support/ca-support-online/documents.aspx?id=177782

Regards,

Ken Williams
Vulnerability Response Director, CA Product Vulnerability Response Team

Copyright (c) 2016 CA. All Rights Reserved. 520 Madison Avenue, 22nd 
Floor, New York, NY 10022. All other trademarks, trade names, service 
marks, and logos referenced herein belong to their respective companies.

-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 16620)
Charset: utf-8

wsFVAwUBWCO8pjuotw2cX+zOAQrdBhAAk/TAQ+kNGxUGvNF4R8VX6Q8olUoZO/sg
q4/t9MVAybGrzV/VQe3zzMWkSR3rbbbV8C8GAWBMZbZ/RjOTiX//L2Cy/uXpzRPo
BF5RL5B3NkCIyRN1Ujh/812hXmSBSiFRJchZOSLBnGNAEE0VeTnuDAQjolzSVr9Q
FTqggxkXLwv00GH+12RIYlI1YRoS9+GEs9zY3qONy1/9HeJSfH2jOiA+3owdtIxB
QSorxmWvpQt9sJRmNi98Jvoyt+HhdXVVdXB6GsthQOKvRsBnBnTENLuaC3g3W8Ur
MI2Rjs9ioujyAeLT4i/5pAk3e9w5ix7078cPzBf5bGPHRN8WwXUgJwOQzwc9IJr4
Vqv/kJsqdRTPevLnl0uZcpcTmmzACRVW3I+XqdslOFPzlx9jGogPoUF/S6nCfmZX
tG+nWyMxTpi0JU9xEqqIvIB6bME6GwlkJ+acuP2k+oBuEMs/lkk4C83RHHmvlg1t
0pjnrpBN/tGeJxXzjhU0rncDEDq5QFI3DeVnqOlL4cpbuV+SBwfD9xiQWtUF9uks
u8z8/oR8mluhV9m5njceGM2ElIOC7iLuOLSfl8wRnF4OI4LB+D8cVI4oFEUNdzEv
6QITaRP85UWK/O4csiw23r74SLrQgndCNDuRz9jT30J9AVDpBRLsbidlNEKdfoJD
gf7R0BB8auY=
=wAmu
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives