CA20111208-01: Security Notice for CA SiteMinder - CA Technologies
{{search ? 'Close':'Search'}}

CA20111208-01: Security Notice for CA SiteMinder

Issued: December 08, 2011
Updated: August 22, 2012

CA Technologies Support is alerting customers to a potential risk in CA SiteMinder, CA Federation Manager, CA SOA Security Manager, CA SiteMinder Secure Proxy Server, and CA SiteMinder SharePoint Agent. A vulnerability exists that can allow a malicious user to execute a reflected cross site scripting (XSS) attack. CA Technologies has issued patches to address the vulnerability.

The vulnerability, CVE-2011-4054, occurs due to insufficient validation of postpreservationdata parameter input utilized in the login.fcc form. A malicious user can submit a specially crafted request to effectively hijack a victim's browser.

Risk Rating

Medium

Platform

All

Affected Products

CA SiteMinder R6 SP6 CR7 and earlier
CA SiteMinder R12 SP3 CR8 and earlier
CA Federation Manager 12.1 SP3 and earlier
CA SOA Security Manager 12.1 SP3 and earlier
CA SiteMinder Secure Proxy Server 12.0 SP3 and earlier
CA SiteMinder Secure Proxy Server 6.0 SP3 and earlier
CA SiteMinder SharePoint Agent 12.0 SP3 and earlier

Non-Affected Products

CA SiteMinder R6 SP6 CR8
CA SiteMinder R12 SP3 CR9
CA Federation Manager 12.1 SP3 CR00.1
CA SOA Security Manager 12.1 SP3 CR01.1
CA SiteMinder Secure Proxy Server 12.0 SP3 CR01.1
CA SiteMinder Secure Proxy Server 6.0 SP3 CR07.1
CA SiteMinder SharePoint Agent 12.0 SP3 CR0.1

How to determine if the installation is affected

Check the Web Agent log or Installation log to obtain the installed release version. Note that the "webagent.log" file name is configurable by the SiteMinder administrator.

Solution

CA has issued patches to address the vulnerability.

CA SiteMinder R6:
Upgrade to R6 SP6 CR8 or later

CA SiteMinder R12:
Upgrade to R12 SP3 CR9 or later

CA Federation Manager 12.1 SP3:
Apply fix RS47435

CA SOA Security Manager 12.1 SP3:
Apply fix RS47436

CA SiteMinder Secure Proxy Server 12.0 SP3:
Apply fix RS47431

CA SiteMinder Secure Proxy Server 6.0 SP3:
Apply fix RS47432

CA SiteMinder SharePoint Agent 12.0 SP3:
Apply fix RS47433

CR releases can be found on the CA SiteMinder Hotfix/Cumulative Release page:
https://support.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/technical-document-index/ca-single-sign-on-hotfix-cumulative-release-index.html.

Workaround

None

References

CVE-2011-4054 - CA SiteMinder login.fcc XSS

Acknowledgement

CVE-2011-4054 - Jon Passki of Aspect Security, via CERT

Change History

Version 1.0: Initial Release
Version 1.1: Updated R6 fix information
Version 1.2: Added information for Federation Manager, SOA Security Manager, SiteMinder Secure Proxy Server, SiteMinder SharePoint Agent

If additional information is required, please contact CA Technologies Support at https://support.ca.com.

If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team.

Chat with CA

Just give us some brief information and we'll connect you to the right CA Expert.

Our hours of availability are 8AM - 5PM CST.

All Fields Required

connecting

We're matching your request.

Unfortunately, we can't connect you to an agent. If you are not automatically redirected please click here.

  • {{message.agentProfile.name}} will be helping you today.

    View Profile


  • Transfered to {{message.agentProfile.name}}

    {{message.agentProfile.name}} joined the conversation

    {{message.agentProfile.name}} left the conversation

  • Your chat with {{$storage.chatSession.messages[$index - 1].agentProfile.name}} has ended.
    Thank you for your interest in CA.


    How Did We Do?
    Let us know how we did so that we can maintain a quality experience.

    Take Our Survey >

    Rate Your Chat Experience.

    {{chat.statusMsg}}

agent is typing