CA20130528-01: Security Notice for CA Process Automation (CA PAM)
Issued: May 28, 2013
Last Updated: June 12, 2013
CA Technologies support is alerting customers to a vulnerability with CA Process Automation (CA PAM). The vulnerability, CVE-2010-1871, occurs in the bundled JBoss Seam component. A remote attacker can execute arbitrary code.
All supported platforms
CA Process Automation 4.0
CA Process Automation 4.0 SP1
CA Process Automation 4.1
CA Process Management for Workflows 4.0
CA Process Management for Workflows 4.0 SP1
CA Process Management for Workflows 4.1
CA Technologies products that bundle this software include:
CA IT Asset Manager 12.8
CA Server Automation 12.7.1
CA Server Automation 12.8
CA Service Catalog 12.8
CA Service Desk Manager 12.5
CA Service Desk Manager 12.6
CA Service Desk Manager 12.7
CA Process Automation 4.1 SP1*
*Note: If CA Process Automation 4.1 SP1 is installed as an upgrade to an existing vulnerable 4.x release, then the installation may still be vulnerable.
How to determine if the installation is affected
To determine whether the Seam component is installed and enabled, check for the following files. If the files are present, then the installation may be vulnerable.
|Directory ||File |
|<PAM_Home>serverc2odeployers ||seam.deployer |
|<PAM_Home>serverc2odeployers ||webbeans.deployer |
|<PAM_Home>serverc2odeploy ||admin-console.war |
CA Technologies has issued the following remediation to address the vulnerability.
For Process Automation 4.0, 4.0 SP1, 4.1 and Process Management for Workflows 4.0, 4.0 SP1, 4.1:
Apply the manual remediation steps described in TEC591669.
Version 1.0: Initial Release
Version 1.1: 2013-05-30 - Added Process Management for Workflows 4.0 to the Affected Products and Solution sections
Version 1.2: 2013-06-12 - Added Process Automation 4.1 SP1 to Non-Affected Products
If additional information is required, please contact CA Technologies Support at https://support.ca.com/.
If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team.