-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CA20130213-01: Security Notice for CA ControlMinder Issued: February 13, 2013 Last updated: April 29, 2013 CA Technologies support is alerting customers to a potential risk with CA ControlMinder. A vulnerability exists that can allow a remote attacker to execute arbitrary code. CA has issued remediation to address the vulnerability. The vulnerability, CVE-2010-0738, occurs due to the default JBoss Application Server configuration not correctly enforcing authentication. A remote attacker can bypass authentication, which may result in arbitrary code execution and server compromise. This vulnerability only affects the server components. Important: Technical document TEC559568 now contains updated instructions for all affected products. Customers should apply the latest configuration changes from TEC559568 to fully resolve this vulnerability. Risk Rating High Platform Windows Linux Solaris Affected Products CA ControlMinder for Windows 12.5, 12.6, 12.6 SP1 (formerly CA Access Control) CA ControlMinder for Linux 12.5, 12.6, 12.6 SP1 CA ControlMinder SAM 12.5, 12.6, 12.6 SP1 CA ControlMinder Upgrade 12.6 CA ControlMinder for Virtual Environments 2.0 Non-Affected Products CA ControlMinder for Windows 12.7 CA ControlMinder for Linux 12.7 How to determine if the installation is affected Review the instructions from TEC559568 to determine whether the configuration changes are implemented for affected releases. Solution CA Technologies has issued the following remediation to address the vulnerability. All updates are available through the Download Center on the CA Technologies support website. Note CA ControlMinder for Windows and Linux 12.7 are not affected. For CA ControlMinder on all platforms, update as follows: CA ControlMinder for Windows 12.6: CA ControlMinder Premium Edition 12.6 SP1 Server Components for Windows DVD06135111E.iso Also apply the configuration changes for 12.6 from TEC559568. CA ControlMinder for Linux 12.6: CA ControlMinder Premium Edition 12.6 SP1 Server Components for Linux DVD06134958E.iso Also apply the configuration changes for 12.6 from TEC559568. CA ControlMinder SAM 12.6: CA ControlMinder Premium Edition 12.6 SP1 Server Components for Linux DVD06134958E.iso Also apply the configuration changes for 12.6 from TEC559568. CA ControlMinder Upgrade 12.6: CA ControlMinder Premium Edition 12.6 SP1 Server Components for Linux DVD06134958E.iso Also apply the configuration changes for 12.6 from TEC559568. CA ControlMinder for Virtual Environments 2.0: Access Control for Virtual Environments 2.0 CR DVD01091214E.iso Also apply the configuration changes for 12.6 from TEC559568. CA ControlMinder 12.5 all releases on all platforms: Follow the instructions for 12.5 in TEC559568. Workaround See TEC559568 for instructions on how to properly enable authentication. References CVE-2010-0738 CA20130213-01: Security Notice for CA ControlMinder https://support.ca.com/irj/portal/anonymous/phpsbpldgpg Acknowledgement Sanehdeep Singh, Jainam Technologies Pvt. Ltd. Change History Version 1.0: Initial Release Version 1.1: 2013-04-29 Added 12.6 SP1 to Affected Products, updated the Non-Affected products list, added additional fix information for all releases in the Solution section, updated the description to state customers should implement the latest recommended configuration changes, and modified the How to determine the installation is affected section. If additional information is required, please contact CA Technologies Support at http://support.ca.com/ If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team: https://support.ca.com/irj/portal/anonymous/phpsbpldgpg Regards, Kevin Kotas Director, CA Technologies Product Vulnerability Response Team Copyright (c) 2013 CA. All Rights Reserved. One CA Plaza, Islandia, N.Y. 11749. All other trademarks, trade names, service marks, and logos referenced herein belong to their respective companies. -----BEGIN PGP SIGNATURE----- Charset: utf-8 wj8DBQFRfv8qIJ/qtDktDKARAoWhAKD/lvVeiUM7LurJSqoU52YkZwIE/QCfdIjx hCh418mX9GqQKgeUMPaQ93Q= =DmAT -----END PGP SIGNATURE-----