exploit the possibilities

CA SiteMinder Cross Site Scripting

CA SiteMinder Cross Site Scripting
Posted Aug 28, 2012
Authored by Ken Williams | Site www3.ca.com

CA Technologies Support is alerting customers to a potential risk in CA SiteMinder, CA Federation Manager, CA SOA Security Manager, CA SiteMinder Secure Proxy Server, and CA SiteMinder SharePoint Agent. A vulnerability exists that can allow a malicious user to execute a reflected cross site scripting (XSS) attack. CA Technologies has issued patches to address the vulnerability. The vulnerability occurs due to insufficient validation of postpreservationdata parameter input utilized in the login.fcc form. A malicious user can submit a specially crafted request to effectively hijack a victim's browser.

tags | advisory, xss
advisories | CVE-2011-4054
MD5 | 1886e054d2dd6edc825527c893bea3d2

CA SiteMinder Cross Site Scripting

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CA20111208-01: Security Notice for CA SiteMinder


Issued: December 08, 2011
Updated: August 22, 2012


CA Technologies Support is alerting customers to a potential risk in
CA SiteMinder, CA Federation Manager, CA SOA Security Manager, CA
SiteMinder Secure Proxy Server, and CA SiteMinder SharePoint Agent. A
vulnerability exists that can allow a malicious user to execute a
reflected cross site scripting (XSS) attack. CA Technologies has
issued patches to address the vulnerability.

The vulnerability, CVE-2011-4054, occurs due to insufficient
validation of postpreservationdata parameter input utilized in the
login.fcc form. A malicious user can submit a specially crafted
request to effectively hijack a victim's browser.


Risk Rating

Medium


Platform

All


Affected Products

CA SiteMinder R6 SP6 CR7 and earlier
CA SiteMinder R12 SP3 CR8 and earlier
CA Federation Manager 12.1 SP3 and earlier
CA SOA Security Manager 12.1 SP3 and earlier
CA SiteMinder Secure Proxy Server 12.0 SP3 and earlier
CA SiteMinder Secure Proxy Server 6.0 SP3 and earlier
CA SiteMinder SharePoint Agent 12.0 SP3 and earlier


Non-Affected Products

CA SiteMinder R6 SP6 CR8
CA SiteMinder R12 SP3 CR9
CA Federation Manager 12.1 SP3 CR00.1
CA SOA Security Manager 12.1 SP3 CR01.1
CA SiteMinder Secure Proxy Server 12.0 SP3 CR01.1
CA SiteMinder Secure Proxy Server 6.0 SP3 CR07.1
CA SiteMinder SharePoint Agent 12.0 SP3 CR0.1


How to determine if the installation is affected

Check the Web Agent log or Installation log to obtain the installed
release version. Note that the "webagent.log" file name is
configurable by the SiteMinder administrator.


Solution

CA has issued patches to address the vulnerability.

CA SiteMinder R6:
Upgrade to R6 SP6 CR8 or later

CA SiteMinder R12:
Upgrade to R12 SP3 CR9 or later

CA Federation Manager 12.1 SP3:
Apply fix RS47435

CA SOA Security Manager 12.1 SP3:
Apply fix RS47436

CA SiteMinder Secure Proxy Server 12.0 SP3:
Apply fix RS47431

CA SiteMinder Secure Proxy Server 6.0 SP3:
Apply fix RS47432

CA SiteMinder SharePoint Agent 12.0 SP3:
Apply fix RS47433

CR releases can be found on the CA SiteMinder Hotfix/Cumulative
Release page (URL may wrap):
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={5AE61E
29-C3DE-405E-9151-9EEA72D965CE}.


Workaround

None


References

CVE-2011-4054 - CA SiteMinder login.fcc XSS

Acknowledgement

CVE-2011-4054 - Jon Passki of Aspect Security, via CERT

Change History

Version 1.0: Initial Release
Version 1.1: Updated R6 fix information
Version 1.2: Added information for Federation Manager, SOA Security
Manager, SiteMinder Secure Proxy Server, SiteMinder SharePoint Agent


If additional information is required, please contact CA Technologies
Support at https://support.ca.com.

If you discover a vulnerability in a CA Technologies product, please
report your findings to the CA Technologies Product Vulnerability
Response Team.
support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782


Thanks and regards,
Ken Williams, Director
CA Technologies Product Vulnerability Response Team
CA Technologies Business Unit Operations
wilja22@ca.com

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.9.1 (Build 287)
Charset: utf-8

wj8DBQFQO7sGeSWR3+KUGYURAvlVAJwNzRfo5NORDDMQhau8SfLHOGnMqACfYEfY
xM1DGynkf5e0fdgSVhvVYGM=
=JTJo
-----END PGP SIGNATURE-----


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    10 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close