full-disclosure - [FD] CA20181017-01: Security Notice for CA Identity Governance

Open Source and information security mailing list archives

Message-ID: <DM6PR01MB410823D6A15F25E5DC97C76D84FF0@DM6PR01MB4108.prod.exchangelabs.com>
Date: Wed, 17 Oct 2018 22:14:59 +0000
From: "Kotas, Kevin J" <Kevin.Kotas@...com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] CA20181017-01: Security Notice for CA Identity Governance

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

CA20181017-01: Security Notice for CA Identity Governance

Issued: October 17, 2018
Last Updated: October 17, 2018

CA Technologies Support is alerting customers to a low risk issue
with CA Identity Governance. In a certain product configuration, an
attacker can gain sensitive information. CA published solutions to
address the vulnerability.

The vulnerability, CVE-2018-14597, occurs due to how CA Identity
Governance responds to login requests. An attacker may exploit the
vulnerability to enumerate account names.

Risk Rating

Low

Platform(s)

All supported platforms

Affected Products

CA Identity Suite Virtual Appliance 14.0
CA Identity Suite Virtual Appliance 14.1
CA Identity Suite Virtual Appliance 14.2

CA Identity Governance 12.6
CA Identity Governance 14.0
CA Identity Governance 14.1
CA Identity Governance 14.2

How to determine if the installation is affected

Customers may verify the cumulative fix level of CA Identity Suite
Virtual Appliance 14.1 and CA Identity Governance 14.1 as indicated
in the Solution section.

For the remaining product releases, CA customers should apply the
fixes from the Solution section and keep a log for future validation.

Solution

CA Technologies published the following solutions to address the
vulnerability.

CA Identity Suite Virtual Appliance 14.0:
SS05684

CA Identity Suite Virtual Appliance 14.1:
Update to CP-IGV-140100-0002 or later

CA Identity Suite Virtual Appliance 14.2:
SS05686

CA Identity Governance 14.2:
SS05315

CA Identity Governance 14.1:
Update to CP-IG-140100-0003 or later

CA Identity Governance 14.0:
SS05312

CA Identity Governance 12.6:
SS05311

References

CVE-2018-14597 - Identity Governance username enumeration

Acknowledgement

CVE-2018-14597 - Jake Miller

Change History

Version 1.0: 2018-10-17 - Initial Release

Customers who require additional information about this notice may
contact CA Technologies Support at https://support.ca.com/

To report a suspected vulnerability in a CA Technologies product,
please send a summary to CA Technologies Product Vulnerability
Response at vuln <AT> ca.com

Security Notices and PGP key
support.ca.com/irj/portal/anonymous/phpsbpldgpg
www.ca.com/us/support/ca-support-online/documents.aspx?id=177782

Regards,

Kevin Kotas
Vulnerability Response Director
CA Technologies Product Vulnerability Response

Copyright (c) 2018 CA. 520 Madison Avenue, 22nd Floor, New York, NY
10022.  All other trademarks, trade names, service marks, and logos
referenced herein belong to their respective companies.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives