Published:
June 15 2009, 10:30 PM
|
no comments
by
Ken Williams
On June 15th, 2009, CA published a security notice to address a vulnerability in CA Service Desk.
Title: CA20090615-02: CA Service Desk Tomcat Cross Site Scripting Vulnerability
CA Advisory Reference: CA20090615-02
CA Advisory Date: 2009-06-15
Impact: A remote attacker can inject arbitrary web script or HTML.
Summary: The release of Tomcat as included with CA Service Desk r11.2 is potentially susceptible to a cross-site scripting vulnerability. CA has issued a technical document that describes remediation procedures.
Mitigating Factors: None
Severity: CA has given this vulnerability a Medium risk rating.
Affected Products:
CA Service Desk r11.2
Affected Platforms:
Windows, Unix
Status and Recommendation:
Follow the instructions in technical document TEC489643.
How to determine if the installation is affected:
Customers can use the instructions in technical document TEC489643 to determine if an installation may be affected.
Workaround:
None
References (URLs may wrap):
CA Support:
https://support.ca.com/
CA20090615-02: Security Notice for CA Service Desk
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=209500
Solution Document Reference APARs:
TEC489643
CA Security Response Blog posting:
CA20090615-02: CA Service Desk Tomcat Cross Site Scripting Vulnerability
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15.aspx
CVE References:
CVE-2008-1232
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1232
OSVDB References: Pending
http://osvdb.org/
Changelog for this advisory:
v1.0 - Initial Release
Customers who require additional information should contact CA Technical Support at https://support.ca.com.
For technical questions or comments related to this advisory, please send email to vuln AT ca DOT com.
If you discover a vulnerability in CA products, please report your findings to the CA Product Vulnerability Response Team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782
The opinions and statements on this site are my own and do not necessarily reflect the opinions or policies of CA.
By: Ken Williams
Ken Williams is a Director with the CA Vulnerability Research Team. As a veteran vulnerability researcher, Ken has worked as the Director of the CA Vulnerability Research Team and eVM Research Team, Director of Vulnerability Research at eSecurityOnline, Manager of the Vulnerability Research Team at Ernst...
Read More..
Published:
June 15 2009, 10:00 PM
|
no comments
by
Ken Williams
On June 15th, 2009, CA published a security notice to address multiple vulnerabilities in CA ARCserve Backup.
Title: CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities
CA Advisory Reference: CA20090615-01
CA Advisory Date: 2009-06-15
Reported By: iViZ Security Research Team
Impact: A remote attacker can cause a denial of service.
Summary: CA ARCserve Backup contains multiple vulnerabilities in the message engine that can allow a remote attacker to cause a denial of service. CA has issued an update to address the vulnerabilities. The vulnerabilities, CVE-2009-1761, occur due to insufficient verification of data sent to the message engine. An attacker can make requests that can cause the message engine to crash.
Mitigating Factors: None
Severity: CA has given these vulnerabilities a Medium risk rating.
Affected Products:
CA ARCserve Backup r12.0 Windows
CA ARCserve Backup r12.0 SP 1 Windows
Non-Affected Products:
CA ARCserve Backup r11.5 SP 4 Windows
CA ARCserve Backup r12.0 SP 2 Windows
CA ARCserve Backup r12.5
Affected Platforms:
Windows
Status and Recommendation:
CA has issued the following patches to address the vulnerabilities.
CA ARCserve Backup r12.0, r12.0 SP1 Windows:
Install Service Pack 2 RO08383.
How to determine if the installation is affected:
CA ARCserve Backup r12.0, r12.0 SP1 Windows:
1. Run the ARCserve Patch Management utility. From the Windows Start menu, the program can be found under Programs->CA->ARCserve Patch Management->Patch Status.
2. The main patch status screen will indicate if the patch in the below table is applied. If the patch is not applied, then the installation is vulnerable.
| Product | Patch |
| CA ARCserve Backup r12.0, r12.0 SP1 Windows | RO08383 |
For more information on the ARCserve Patch Management utility, read document TEC446265.
Workaround: None
References (URLs may wrap):
CA Support:
https://support.ca.com/
CA20090615-01: Security Notice for CA ARCserve Backup Message Engine
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=209502
Solution Document Reference APARs:
RO08383, TEC446265
CA Security Response Blog posting:
CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15.aspx
Reported By:
iViZ Security Research Team
http://www.ivizsecurity.com/security-advisory-iviz-sr-09003.html
http://www.ivizsecurity.com/security-advisory-iviz-sr-09004.html
CVE References:
CVE-2009-1761
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1761
OSVDB References: Pending
http://osvdb.org/
Changelog for this advisory:
v1.0 - Initial Release
Customers who require additional information should contact CA Technical Support at https://support.ca.com.
For technical questions or comments related to this advisory, please send email to vuln AT ca DOT com.
If you discover a vulnerability in CA products, please report your findings to the CA Product Vulnerability Response Team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782
The opinions and statements on this site are my own and do not necessarily reflect the opinions or policies of CA.
By: Ken Williams
Ken Williams is a Director with the CA Vulnerability Research Team. As a veteran vulnerability researcher, Ken has worked as the Director of the CA Vulnerability Research Team and eVM Research Team, Director of Vulnerability Research at eSecurityOnline, Manager of the Vulnerability Research Team at Ernst...
Read More..