lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <ED311CBEE6993C428563DEDF6D083BC8709189E1@usilms113b.ca.com> Date: Mon, 27 Aug 2012 18:26:00 +0000 From: "Williams, James K" <James.Williams@...com> To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk> Subject: CA20111208-01: Security Notice for CA SiteMinder [updated] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CA20111208-01: Security Notice for CA SiteMinder Issued: December 08, 2011 Updated: August 22, 2012 CA Technologies Support is alerting customers to a potential risk in CA SiteMinder, CA Federation Manager, CA SOA Security Manager, CA SiteMinder Secure Proxy Server, and CA SiteMinder SharePoint Agent. A vulnerability exists that can allow a malicious user to execute a reflected cross site scripting (XSS) attack. CA Technologies has issued patches to address the vulnerability. The vulnerability, CVE-2011-4054, occurs due to insufficient validation of postpreservationdata parameter input utilized in the login.fcc form. A malicious user can submit a specially crafted request to effectively hijack a victim's browser. Risk Rating Medium Platform All Affected Products CA SiteMinder R6 SP6 CR7 and earlier CA SiteMinder R12 SP3 CR8 and earlier CA Federation Manager 12.1 SP3 and earlier CA SOA Security Manager 12.1 SP3 and earlier CA SiteMinder Secure Proxy Server 12.0 SP3 and earlier CA SiteMinder Secure Proxy Server 6.0 SP3 and earlier CA SiteMinder SharePoint Agent 12.0 SP3 and earlier Non-Affected Products CA SiteMinder R6 SP6 CR8 CA SiteMinder R12 SP3 CR9 CA Federation Manager 12.1 SP3 CR00.1 CA SOA Security Manager 12.1 SP3 CR01.1 CA SiteMinder Secure Proxy Server 12.0 SP3 CR01.1 CA SiteMinder Secure Proxy Server 6.0 SP3 CR07.1 CA SiteMinder SharePoint Agent 12.0 SP3 CR0.1 How to determine if the installation is affected Check the Web Agent log or Installation log to obtain the installed release version. Note that the "webagent.log" file name is configurable by the SiteMinder administrator. Solution CA has issued patches to address the vulnerability. CA SiteMinder R6: Upgrade to R6 SP6 CR8 or later CA SiteMinder R12: Upgrade to R12 SP3 CR9 or later CA Federation Manager 12.1 SP3: Apply fix RS47435 CA SOA Security Manager 12.1 SP3: Apply fix RS47436 CA SiteMinder Secure Proxy Server 12.0 SP3: Apply fix RS47431 CA SiteMinder Secure Proxy Server 6.0 SP3: Apply fix RS47432 CA SiteMinder SharePoint Agent 12.0 SP3: Apply fix RS47433 CR releases can be found on the CA SiteMinder Hotfix/Cumulative Release page (URL may wrap): https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={5AE61E 29-C3DE-405E-9151-9EEA72D965CE}. Workaround None References CVE-2011-4054 - CA SiteMinder login.fcc XSS Acknowledgement CVE-2011-4054 - Jon Passki of Aspect Security, via CERT Change History Version 1.0: Initial Release Version 1.1: Updated R6 fix information Version 1.2: Added information for Federation Manager, SOA Security Manager, SiteMinder Secure Proxy Server, SiteMinder SharePoint Agent If additional information is required, please contact CA Technologies Support at https://support.ca.com. If you discover a vulnerability in a CA Technologies product, please report your findings to the CA Technologies Product Vulnerability Response Team. support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782 Thanks and regards, Ken Williams, Director CA Technologies Product Vulnerability Response Team CA Technologies Business Unit Operations wilja22@...com -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.9.1 (Build 287) Charset: utf-8 wj8DBQFQO7sGeSWR3+KUGYURAvlVAJwNzRfo5NORDDMQhau8SfLHOGnMqACfYEfY xM1DGynkf5e0fdgSVhvVYGM= =JTJo -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists