mailing list archives
RE: CA20110420-02: Security Notice for CA Output Management Web Viewer
From: "Williams, James K" <James.Williams () ca com>
Date: Thu, 19 May 2011 12:14:43 -0400
CA20110420-01: Security Notice for CA SiteMinder
Issued: April 20, 2011
Updated: May 19, 2011
CA Technologies support is alerting customers to a security risk
associated with CA SiteMinder. A vulnerability exists that can allow a
malicious user to impersonate another user. CA Technologies has
issued patches to address the vulnerability.
The vulnerability, CVE-2011-1718, is due to improper handling of
multi-line headers. A malicious user can send specially crafted data
to impersonate another user.
CA SiteMinder R6 IIS 6.0 Web Agents prior to R6 SP6 CR2
CA SiteMinder R12 IIS 6.0 Web Agents prior to R12 SP3 CR2
How to determine if the installation is affected
Check the Web Agent log to obtain the installed release version. Note
that the "webagent.log" file name is configurable by the SiteMinder
CA has issued patches to address the vulnerability.
CA SiteMinder R6:
Upgrade to R6 SP6 CR2 or later
CA SiteMinder R12:
Upgrade to R12 SP3 CR2 or later
CR releases can be found on the CA SiteMinder Hotfix / Cumulative
(URL may wrap)
CVE-2011-1718 - CA SiteMinder Multi-line Header Vulnerability
April King (april () twoevils org)
Version 1.0: Initial Release
Version 1.1: Updated Affected Products section to clarify that only
the IIS 6.0 Web Agents are affected. ISS 7 is not
affected by this issue.
If additional information is required, please contact CA Technologies
Support at https://support.ca.com.
If you discover a vulnerability in a CA Technologies product, please
report your findings to the CA Technologies Product Vulnerability
- RE: CA20110420-02: Security Notice for CA Output Management Web Viewer Williams, James K (May 19)