lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 3 Oct 2019 22:25:28 -0400
From: Kevin Kotas <>
Subject: CA20190930-01: Security Notice for CA Network Flow Analysis

Hash: SHA256

CA20190930-01: Security Notice for CA Network Flow Analysis

Issued: September 30th, 2019

CA Technologies, a Broadcom Company, is alerting customers to a
potential risk with CA Network Flow Analysis. A vulnerability exists
that can allow a remote attacker to execute arbitrary commands. CA
published a solution to address the vulnerabilities and recommends
that all affected customers implement this solution.

The vulnerability, CVE-2019-13658, occurs due to default credentials
and a configuration weakness. A malicious actor may use the default
credentials and exploit a weakness in the configuration to execute
arbitrary commands on the CA Network Flow Analysis server.

Risk Rating



All supported platforms

Affected Products

CA Network Flow Analysis 10.0.x
CA Network Flow Analysis 9.x

How to determine if the installation is affected

Customers may use the product version to determine if their product
installation is affected.


The following solution is available to address the vulnerability.
Note that the typical deployment of CA Network Flow Analysis is in an
internal network and system administrators should restrict access to
sensitive ports (see Firewall Configuration) on the CA Network Flow
Analysis server.

CA Network Flow Analysis 9.x and 10.0.x:
Customers should update to CA Network Flow Analysis 10.0.2 or later
and change the MySQL passwords as described at Configure MySQL User


CVE-2019-13658 - CA Network Flow Analysis default credentials


CVE-2019-13658 - Hendrik Van Belleghem

Change History

Version 1.0: 2019-09-30 - Initial Release

CA customers may receive product alerts and advisories by subscribing
to Proactive Notifications on the support site.

Customers who require additional information about this notice may
contact CA Technologies Support at

To report a suspected vulnerability in a CA Technologies product,
please send a summary to CA Technologies Product Vulnerability
Response at ca.psirt <AT>

Security Notices, PGP key, and disclosure policy and guidance

Kevin Kotas
CA Product Security Incident Response Team

Copyright 2019 Broadcom. All Rights Reserved. The term "Broadcom"
refers to Broadcom Inc. and/or its subsidiaries. Broadcom, the pulse
logo, Connecting everything, CA Technologies and the CA technologies
logo are among the trademarks of Broadcom. All trademarks, trade
names, service marks and logos referenced herein belong to their
respective companies.

Charset: utf-8


Powered by blists - more mailing lists