bugtraq - CA20141103-01: Security Notice for CA Cloud Service Management

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <c2d98c3337e941c1a946b9efec26dd1d@usilms210.ca.com>
Date: Thu, 6 Nov 2014 19:13:40 +0000
From: "Kotas, Kevin J" <Kevin.Kotas@...com>
To: "'bugtraq' \(bugtraq@...urityfocus.com\)" <bugtraq@...urityfocus.com>
Subject: CA20141103-01: Security Notice for CA Cloud Service Management

-----BEGIN PGP SIGNED MESSAGE-----

CA20141103-01: Security Notice for CA Cloud Service Management

Issued: November 3, 2014

CA Technologies Support is alerting customers to four resolved
vulnerabilities with CA Cloud Service Management. Four vulnerabilities
existed that could potentially allow a remote attacker to access user
sessions, gain sensitive information, or cause a denial of service
condition. CA Technologies fixed these vulnerabilities in all
production environments as part of the Cloud Service Management
Summer 2014 Upgrade.

The first vulnerability, CVE-2014-8471, concerned a replay attack. An
attacker would have needed access to a user's environment in order to
carry out this attack.

The second vulnerability, CVE-2014-8472, involved Identity Provider
authentication token verification. An attacker would have needed to
manipulate a user in order to exploit this vulnerability.

The third vulnerability, CVE-2014-8473, is a cross-site request
forgery vulnerability. An attacker would have needed to manipulate a
user in order to exploit this vulnerability.

The fourth vulnerability, CVE-2014-8474, is an XML external entity
vulnerability that could have allowed an attacker to potentially gain
sensitive information or cause a denial of service condition.

Risk Rating

High

Note: These vulnerabilities no longer pose any risk to customers.

Affected Products

CA Cloud Service Management Spring release

Unaffected Products

CA Cloud Service Management Summer 2014 Upgrade

Solution

CA Technologies addressed these vulnerabilities with the Cloud
Service Management Summer 2014 Upgrade.

References

CVE-2014-8471 - CSM replay
CVE-2014-8472 - CSM Identity Provider
CVE-2014-8473 - CSM CSRF
CVE-2014-8474 - CSM XXE

Acknowledgement

CVE-2014-8471, CVE-2014-8472, CVE-2014-8473, CVE-2014-8474 -
Vladislav Mladenov, Julian Krautwald, Florian Feldmann and Christian
Mainka (@CheariX), Security researchers at Horst Görtz Institute for
IT-Security / Chair for Network and Data Security

Change History

Version 1.0: Initial Release

If additional information is required, please contact CA Technologies
Support at https://support.ca.com/

If you discover a vulnerability in CA Technologies products, please
report your findings to the CA Technologies Product Vulnerability
Response Team at vuln@...com

Security Notices
https://support.ca.com/irj/portal/anonymous/phpsbpldgpg

Regards,

Kevin Kotas
Vulnerability Response Director
CA Technologies Product Vulnerability Response Team

Copyright (c) 2014 CA. All Rights Reserved. One CA Plaza, Islandia,
N.Y. 11749. All other trademarks, trade names, service marks, and
logos referenced herein belong to their respective companies.

-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 15238)
Charset: utf-8

wsBVAwUBVFu+9pI1FvIeMomJAQE4NQf+ITNLgXAJt0HID9KlyZSFEzG5XRqNL8P9
UlZxKA/IahlLdSvbNZ6UmM1jTtr+hv1HQK87lWFxqARZL7YcpDUeVWbuqT3SVZCy
MT0Kd1MzGPBN6E+wvRHfa0Mp/b3cPbcsVnxRZrUQc+6zM8UtXoqNiUgPsZkfreD4
KnknGnri43G100fqjFEe21ChfBHql/cHFpnz21lvZx4acdcC0WfqvBzXfDKzr/zu
uKtcP4XcoAyk/zbmugPDuk8TgCBtrm69gAiwiiSMh53HsF/K9BGIJwXPjU9okamc
9heqSPk2RnN7WXL+8szadCTCXjRv5opznDTB8raEi96PqBaUOLRYrw==
=rUT8
-----END PGP SIGNATURE-----