full-disclosure - [FD] CA20190212-01: Security Notice for CA Privileged Access Manager

Open Source and information security mailing list archives

Message-ID: <CAK6erok4yWGQLTZBCeUDR1E0geOwSfhxz4jAJfRnUQLaL9e4cw@mail.gmail.com>
Date: Tue, 12 Feb 2019 19:49:57 -0500
From: Kevin Kotas via Fulldisclosure <fulldisclosure@...lists.org>
To: fulldisclosure@...lists.org
Subject: [FD] CA20190212-01: Security Notice for CA Privileged Access Manager

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

CA20190212-01: Security Notice for CA Privileged Access Manager

Issued: February 12, 2019
Last Updated: February 12, 2019

CA Technologies Support is alerting customers to a potential risk
with CA Privileged Access Manager. A vulnerability exists that can
allow a remote attacker to access sensitive information or modify
configuration. CA published solutions to address the vulnerabilities.

CVE-2019-7392 describes a vulnerability resulting from inadequate
access controls for the components jk-manager and jk-status web
service allowing a remote attacker to access the CA PAM Web-UI
without authentication

Risk Rating

High

Platform(s)

All platforms

Affected Products

CA Privileged Access Manager 3.2.1 and prior releases
CA Privileged Access Manager 3.1.2 and prior releases
CA Privileged Access Manager 3.0.x

How to determine if the installation is affected

Customers may check the version of the product to determine if they
are running a vulnerable release.

Solution

CA Privileged Access Manager 3.2.1 and prior releases:
Update to CA Privileged Access Manager 3.2.2 or later

CA Privileged Access Manager 3.1.2 and prior releases:
Update to CA Privileged Access Manager 3.1.3 or later

CA Privileged Access Manager 3.0.x:
Contact CA support for guidance

References

CVE-2019-7392 - CA Privileged Access Manager jk-manager and jk-status
access

Acknowledgement

CVE-2019-7392 - Bob Brust

Change History

Version 1.0: 2019-02-12 - Initial Release

CA customers may receive product alerts and advisories by subscribing
to Proactive Notifications.

Customers who require additional information about this notice may
contact CA Technologies Support at http://support.ca.com/.

To report a suspected vulnerability in a CA Technologies product,
please send a summary to CA Technologies Product Vulnerability
Response at vuln <AT> ca.com

Security Notices and PGP key
support.ca.com/irj/portal/anonymous/phpsbpldgpg
www.ca.com/us/support/ca-support-online/documents.aspx?id=177782

Kevin Kotas
Vulnerability Response Director
CA Technologies Product Vulnerability Response

Copyright 2019 Broadcom. All Rights Reserved. The term "Broadcom"
refers to Broadcom Inc. and/or its subsidiaries. Broadcom, the pulse
logo, Connecting everything, CA Technologies and the CA technologies
logo are among the trademarks of Broadcom. All trademarks, trade
names, service marks and logos referenced herein belong to their
respective companies.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives