-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CA20170126-01: Security Notice for CA Common Services casrvc Issued: January 26, 2017 Last Updated: January 26, 2017 CA Technologies support is alerting customers about a medium risk vulnerability that may allow a local attacker to gain additional privileges with products using CA Common Services running on the AIX, HP-UX, Linux, and Solaris platforms. The vulnerability, CVE-2016-9795, occurs due to insufficient validation by the casrvc program. A local unprivileged user can exploit the vulnerability to modify arbitrary files, which can potentially allow a local attacker to gain root level access. Risk Rating Medium Platforms AIX, HP-UX, Linux, Solaris Affected Products CA Common Services Products that include CA Common Services: CA Client Automation 12.8, 12.9, 14.0 CA SystemEDGE 5.8.2, 5.9 CA Systems Performance for Infrastructure Managers 12.8, 12.9 CA Universal Job Management Agent 11.2 CA Virtual Assurance for Infrastructure Managers 12.8, 12.9 CA Workload Automation AE 11, 11.3, 11.3.5, 11.3.6 Unaffected Products CA Common Services for z/OS CA Common Services on the Windows platform How to determine if the installation is affected Customers may use the applyptf or equivalent program to determine if the patch from the solution section is present. Solution CA technologies published a fix to resolve the vulnerability for all affected products. CA Client Automation CA SystemEDGE CA Systems Performance for Infrastructure Managers CA Universal Job Management Agent CA Virtual Assurance for Infrastructure Managers CA Workload Automation AE Install the following fix for CA Common Services on AIX, HP-UX, Linux, or Solaris: RO93360 References CVE-2016-9795 - CA Common Services casrvc local privilege escalation Acknowledgement CVE-2016-9795 - Craig Blackie, NCC Group Version 1.0: Initial Release If additional information is required, please contact CA Technologies Support at https://support.ca.com/ If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team at vuln ca.com Security Notices and PGP key support.ca.com/irj/portal/anonymous/phpsbpldgpg www.ca.com/us/support/ca-support-online/documents.aspx?id=177782 Regards, Kevin Kotas Vulnerability Response Director CA Technologies Product Vulnerability Response Team Copyright (c) 2017 CA. 520 Madison Avenue, 22nd Floor, New York, NY 10022. All other trademarks, trade names, service marks, and logos referenced herein belong to their respective companies. -----BEGIN PGP SIGNATURE----- Charset: utf-8 wsFVAwUBWIppdjuotw2cX+zOAQqRUw/+LDmjiKs/T4Mv+X6NMbABVl18F9hdjpJ+ PH5wyx04qhxxcsltNlQu0u7YaNAc9DE2SpXq58A7AxJq5axWcKNLOXpS44exfJEH BprvFxpn5ZOoP4ztVoZrMyr0a6QwFee6QMvAs4T9yaemsH1yfRWa9wr/7V+QsK0u Qj3I9udbqv97BPgbXacgabTaNJLADmmxT6/Zu+wP8pNoQF61brmWUZPRj69MHFKG xIMa6pYUcWK+FzAu2WqtjyBsUX22EkpLgjezmXBeAynPj0zbcVF6c7L02WfVdcyP Ye54jOWv5+HY3VkJL9P9HkhxGBpP/H8Ea6ihvROAL9wzVYIsh9X7+SEWvnFIXgic +U3N1BQFOrp76WPFkFNEsu/tDOlo44VrBdKDEk+EBS0Xd5n+g8caNgKbB50yHTEV Z88VOFd1LlwOEazeDLbOm2n+yZszEX+0yuIbzf1QXYwu2LUxwPhMcIjN0w0rYzdv 99FHHqeJOlv4Yn/ddl3TjTiLS//1jT7pJ1wwU3vnR8D/okbAmOWzSJeD7jIHOYLu txenLve/wnLQJDYY0OEyaldXg83BMumX/8tQkxv2gZ98NwyoOgz7Efcgo343KBlP bx2DnAcvaNrhlXbOowugZ1PsqoCJUh2MI1AJPFZ+52/GTcuLgqqnSB+XuAmPCvsh plG9klqjjXo= =kfYM -----END PGP SIGNATURE-----