exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

CA Common Services casrvc Privilege Escalation

CA Common Services casrvc Privilege Escalation
Posted Jan 28, 2017
Authored by Kevin Kotas | Site www3.ca.com

CA Technologies support is alerting customers about a medium risk vulnerability that may allow a local attacker to gain additional privileges with products using CA Common Services running on the AIX, HP-UX, Linux, and Solaris platforms. The vulnerability, CVE-2016-9795, occurs due to insufficient validation by the casrvc program. A local unprivileged user can exploit the vulnerability to modify arbitrary files, which can potentially allow a local attacker to gain root level access.

tags | advisory, arbitrary, local, root
systems | linux, solaris, aix, hpux
advisories | CVE-2016-9795
SHA-256 | fc6c18b1ab288c81928a10a9339d929938fcd7120518c622254694d974c59667

CA Common Services casrvc Privilege Escalation

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

CA20170126-01: Security Notice for CA Common Services casrvc

Issued: January 26, 2017
Last Updated: January 26, 2017

CA Technologies support is alerting customers about a medium risk
vulnerability that may allow a local attacker to gain additional
privileges with products using CA Common Services running on the AIX,
HP-UX, Linux, and Solaris platforms. The vulnerability, CVE-2016-9795,
occurs due to insufficient validation by the casrvc program. A local
unprivileged user can exploit the vulnerability to modify arbitrary
files, which can potentially allow a local attacker to gain root
level access.

Risk Rating

Medium

Platforms

AIX, HP-UX, Linux, Solaris

Affected Products

CA Common Services

Products that include CA Common Services:

CA Client Automation 12.8, 12.9, 14.0
CA SystemEDGE 5.8.2, 5.9
CA Systems Performance for Infrastructure Managers 12.8, 12.9
CA Universal Job Management Agent 11.2
CA Virtual Assurance for Infrastructure Managers 12.8, 12.9
CA Workload Automation AE 11, 11.3, 11.3.5, 11.3.6

Unaffected Products

CA Common Services for z/OS
CA Common Services on the Windows platform

How to determine if the installation is affected

Customers may use the applyptf or equivalent program to determine if
the patch from the solution section is present.

Solution

CA technologies published a fix to resolve the vulnerability for all
affected products.

CA Client Automation
CA SystemEDGE
CA Systems Performance for Infrastructure Managers
CA Universal Job Management Agent
CA Virtual Assurance for Infrastructure Managers
CA Workload Automation AE

Install the following fix for CA Common Services on AIX, HP-UX,
Linux, or Solaris:

RO93360

References

CVE-2016-9795 - CA Common Services casrvc local privilege escalation

Acknowledgement

CVE-2016-9795 - Craig Blackie, NCC Group

Version 1.0: Initial Release

If additional information is required, please contact CA Technologies
Support at https://support.ca.com/

If you discover a vulnerability in CA Technologies products, please
report your findings to the CA Technologies Product Vulnerability
Response Team at vuln <AT> ca.com

Security Notices and PGP key
support.ca.com/irj/portal/anonymous/phpsbpldgpg
www.ca.com/us/support/ca-support-online/documents.aspx?id=177782

Regards,

Kevin Kotas
Vulnerability Response Director
CA Technologies Product Vulnerability Response Team

Copyright (c) 2017 CA. 520 Madison Avenue, 22nd Floor, New York, NY
10022. All other trademarks, trade names, service marks, and logos
referenced herein belong to their respective companies.

-----BEGIN PGP SIGNATURE-----
Charset: utf-8

wsFVAwUBWIppdjuotw2cX+zOAQqRUw/+LDmjiKs/T4Mv+X6NMbABVl18F9hdjpJ+
PH5wyx04qhxxcsltNlQu0u7YaNAc9DE2SpXq58A7AxJq5axWcKNLOXpS44exfJEH
BprvFxpn5ZOoP4ztVoZrMyr0a6QwFee6QMvAs4T9yaemsH1yfRWa9wr/7V+QsK0u
Qj3I9udbqv97BPgbXacgabTaNJLADmmxT6/Zu+wP8pNoQF61brmWUZPRj69MHFKG
xIMa6pYUcWK+FzAu2WqtjyBsUX22EkpLgjezmXBeAynPj0zbcVF6c7L02WfVdcyP
Ye54jOWv5+HY3VkJL9P9HkhxGBpP/H8Ea6ihvROAL9wzVYIsh9X7+SEWvnFIXgic
+U3N1BQFOrp76WPFkFNEsu/tDOlo44VrBdKDEk+EBS0Xd5n+g8caNgKbB50yHTEV
Z88VOFd1LlwOEazeDLbOm2n+yZszEX+0yuIbzf1QXYwu2LUxwPhMcIjN0w0rYzdv
99FHHqeJOlv4Yn/ddl3TjTiLS//1jT7pJ1wwU3vnR8D/okbAmOWzSJeD7jIHOYLu
txenLve/wnLQJDYY0OEyaldXg83BMumX/8tQkxv2gZ98NwyoOgz7Efcgo343KBlP
bx2DnAcvaNrhlXbOowugZ1PsqoCJUh2MI1AJPFZ+52/GTcuLgqqnSB+XuAmPCvsh
plG9klqjjXo=
=kfYM
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close