CA20130213-01 Security Notice for CA ControlMinder - CA Technologies
{{search ? 'Close':'Search'}}

CA20130213-01: Security Notice for CA ControlMinder

Issued: February 13, 2013
Last updated: April 29, 2013

CA Technologies support is alerting customers to a potential risk with CA ControlMinder. A vulnerability exists that can allow a remote attacker to execute arbitrary code. CA has issued remediation to address the vulnerability.

The vulnerability, CVE-2010-0738, occurs due to the default JBoss Application Server configuration not correctly enforcing authentication. A remote attacker can bypass authentication, which may result in arbitrary code execution and server compromise. This vulnerability only affects the server components.

Important: Technical document TEC559568 now contains updated instructions for all affected products. Customers should apply the latest configuration changes from TEC559568 to fully resolve this vulnerability.

Risk Rating

High

Platform

Windows
Linux
Solaris

Affected Products

CA ControlMinder for Windows 12.5, 12.6, 12.6 SP1 (formerly CA Access Control)
CA ControlMinder for Linux 12.5, 12.6, 12.6 SP1
CA ControlMinder SAM 12.5, 12.6, 12.6 SP1
CA ControlMinder Upgrade 12.6
CA ControlMinder for Virtual Environments 2.0

Non-Affected Products

CA ControlMinder for Windows 12.7
CA ControlMinder for Linux 12.7

How to determine if the installation is affected

Review the instructions from TEC559568 to determine whether the configuration changes are implemented for affected releases.

Solution

CA Technologies has issued the following remediation to address the vulnerability.

All updates are available through the Download Center on the CA Technologies support website.

Note: CA ControlMinder 12.7 for Windows and Linux are not affected.

For CA ControlMinder on all platforms, update as follows:

CA ControlMinder for Windows 12.6:
CA ControlMinder Premium Edition 12.6 SP1 Server Components for Windows
DVD06135111E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder for Linux 12.6:
CA ControlMinder Premium Edition 12.6 SP1 Server Components for Linux
DVD06134958E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder SAM 12.6:
CA ControlMinder Premium Edition 12.6 SP1 Server Components for Linux
DVD06134958E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder Upgrade 12.6:
CA ControlMinder Premium Edition 12.6 SP1 Server Components for Linux
DVD06134958E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder for Virtual Environments 2.0:
Access Control for Virtual Environments 2.0 CR
DVD01091214E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder 12.5 all releases on all platforms:
Follow the instructions for 12.5 in TEC559568.

Workaround

See TEC559568 for instructions on how to properly enable authentication.

References

CVE-2010-0738

Acknowledgement

Sanehdeep Singh, Jainam Technologies Pvt. Ltd.

Change History

Version 1.0: Initial Release
Version 1.1: 2013-04-29 Added 12.6 SP1 to Affected Products, updated the Non-Affected products list, added additional fix information for all releases in the Solution section, updated the description to state customers should implement the latest recommended configuration changes, and modified the How to determine the installation is affected section.

If additional information is required, please contact CA Technologies Support at https://support.ca.com/.

If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team.

Chat with CA

Just give us some brief information and we'll connect you to the right CA Expert.

Our hours of availability are 8AM - 5PM CST.

All Fields Required

connecting

We're matching your request.

Unfortunately, we can't connect you to an agent. If you are not automatically redirected please click here.

  • {{message.agentProfile.name}} will be helping you today.

    View Profile


  • Transfered to {{message.agentProfile.name}}

    {{message.agentProfile.name}} joined the conversation

    {{message.agentProfile.name}} left the conversation

  • Your chat with {{$storage.chatSession.messages[$index - 1].agentProfile.name}} has ended.
    Thank you for your interest in CA.


    How Did We Do?
    Let us know how we did so that we can maintain a quality experience.

    Take Our Survey >

    Rate Your Chat Experience.

    {{chat.statusMsg}}

agent is typing