Message-ID: <50CA915430EBF44B87ADE2DCE06A2CBD78F3EA98@usilms114b.ca.com>
Date: Mon, 29 Apr 2013 23:58:22 +0000
From: "Kotas, Kevin J" <Kevin.Kotas@...com>
To: "'full-disclosure@...ts.grok.org.uk' (full-disclosure@...ts.grok.org.uk)"
 <full-disclosure@...ts.grok.org.uk>
Subject: Updated - CA20130213-01: Security Notice for CA
	ControlMinder

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CA20130213-01: Security Notice for CA ControlMinder

Issued: February 13, 2013
Last updated: April 29, 2013

CA Technologies support is alerting customers to a potential risk
with CA ControlMinder. A vulnerability exists that can allow a remote
attacker to execute arbitrary code. CA has issued remediation to
address the vulnerability.

The vulnerability, CVE-2010-0738, occurs due to the default JBoss
Application Server configuration not correctly enforcing
authentication. A remote attacker can bypass authentication, which
may result in arbitrary code execution and server compromise. This
vulnerability only affects the server components.

Important: Technical document TEC559568 now contains updated
instructions for all affected products. Customers should apply the
latest configuration changes from TEC559568 to fully resolve this
vulnerability.

Risk Rating

High

Platform

Windows
Linux
Solaris

Affected Products

CA ControlMinder for Windows 12.5, 12.6, 12.6 SP1 (formerly CA Access
Control)
CA ControlMinder for Linux 12.5, 12.6, 12.6 SP1
CA ControlMinder SAM 12.5, 12.6, 12.6 SP1
CA ControlMinder Upgrade 12.6
CA ControlMinder for Virtual Environments 2.0

Non-Affected Products

CA ControlMinder for Windows 12.7
CA ControlMinder for Linux 12.7

How to determine if the installation is affected

Review the instructions from TEC559568 to determine whether the
configuration changes are implemented for affected releases.

Solution

CA Technologies has issued the following remediation to address the
vulnerability.

All updates are available through the Download Center on the CA
Technologies support website.

Note CA ControlMinder for Windows and Linux 12.7 are not affected.

For CA ControlMinder on all platforms, update as follows:

CA ControlMinder for Windows 12.6:
CA ControlMinder Premium Edition 12.6 SP1 Server Components for
Windows
DVD06135111E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder for Linux 12.6:
CA ControlMinder Premium Edition 12.6 SP1 Server Components for Linux
DVD06134958E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder SAM 12.6:
CA ControlMinder Premium Edition 12.6 SP1 Server Components for Linux
DVD06134958E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder Upgrade 12.6:
CA ControlMinder Premium Edition 12.6 SP1 Server Components for Linux
DVD06134958E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder for Virtual Environments 2.0:
Access Control for Virtual Environments 2.0 CR
DVD01091214E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder 12.5 all releases on all platforms:
Follow the instructions for 12.5 in TEC559568.

Workaround

See TEC559568 for instructions on how to properly enable
authentication.

References

CVE-2010-0738

CA20130213-01: Security Notice for CA ControlMinder
https://support.ca.com/irj/portal/anonymous/phpsbpldgpg

Acknowledgement

Sanehdeep Singh, Jainam Technologies Pvt. Ltd.

Change History

Version 1.0: Initial Release
Version 1.1: 2013-04-29 Added 12.6 SP1 to Affected Products, updated
the Non-Affected products list, added additional fix information for
all releases in the Solution section, updated the description to
state customers should implement the latest recommended configuration
changes, and modified the How to determine the installation is
affected section.

If additional information is required, please contact CA Technologies
Support at http://support.ca.com/

If you discover a vulnerability in CA Technologies products, please
report your findings to the CA Technologies Product Vulnerability
Response Team:
https://support.ca.com/irj/portal/anonymous/phpsbpldgpg

Regards,

Kevin Kotas
Director, CA Technologies Product Vulnerability Response Team

Copyright (c) 2013 CA. All Rights Reserved. One CA Plaza, Islandia,
N.Y. 11749. All other trademarks, trade names, service marks, and
logos referenced herein belong to their respective companies.

-----BEGIN PGP SIGNATURE-----
Charset: utf-8

wj8DBQFRfv8qIJ/qtDktDKARAoWhAKD/lvVeiUM7LurJSqoU52YkZwIE/QCfdIjx
hCh418mX9GqQKgeUMPaQ93Q=
=DmAT
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists