CA20130725-01 Security Notice for CA Service Desk Manager - CA Technologies
{{search ? 'Close':'Search'}}

CA20130725-01: Security Notice for CA Service Desk Manager

Issued: July 25, 2013

CA Technologies Support is alerting customers to a potential risk with CA Service Desk Manager. A vulnerability exists that can allow a remote attacker to conduct cross-site scripting attacks. CA Technologies published patches to address the vulnerability.

The vulnerability, CVE-2013-2630, occurs due to insufficient verification of URL query string parameters. An attacker, who can have an unsuspecting user follow a carefully constructed URL, may perform various cross-site scripting attacks.

Risk Rating

Medium

Platform

Windows, Sun, AIX, Linux

Affected Products

CA Service Desk Manager 12.5
CA Service Desk Manager 12.6
CA Service Desk Manager 12.7

How to determine if the installation is affected

Steps to identify the Service Desk Manager version and if the relevant patch is installed:

  1. Navigate to the $NX_ROOT directory on the Service Desk Server.

    Note: NX_ROOT points to the Service Desk Manager installation directory which by default is
    "C:Program FilesCAService Desk Manager" for Windows or "/opt/CAisd/" for Solaris, Aix, and Linux.

  2. Identify the Service Desk Manager application version using the following steps:

    1. Navigate to the "$NX_ROOTpdmconf" directory for Windows or "$NX_ROOT/pdmconf/" for Solaris, Aix, and Linux
    2. Locate the file with the name "version" and open it with a text editor.
    3. The version of Service Desk can be noted from the file (Example: Version r12.6).

  3. Locate the file <machine_name>.his under $NX_ROOT directory.

    Note: The file may not exist if the Service Desk Manager server is unpatched.

  4. Open the file with a text editor and locate the patch based on the matrix below for the corresponding Service Desk Manager version and operating system:

    R12.5:
    WINDOWS: RO59355
    LINUX: RO59356
    SUN: RO61158
    AIX: RO61159

    R12.6:
    WINDOWS: RO59358
    LINUX: RO59359
    SUN: RO59360
    AIX: RO59362

    R12.7:
    WINDOWS: RO59560
    LINUX: RO59365
    SUN: RO59366
    AIX: RO59367

    An example entry found in the history file:

    [DATE] - PTF Wizard installed RO59355 (USRD) RELEASE=12.7

  5. If the corresponding patch is not installed, then the installation might be vulnerable.

Solution

CA Technologies published the following patches to address the vulnerabilities.

CA Service Desk Manager 12.5 Windows:
RO59355

CA Service Desk Manager 12.5 Sun:
RO61158

CA Service Desk Manager 12.5 AIX:
RO61159

CA Service Desk Manager 12.5 Linux:
RO59356

CA Service Desk Manager 12.6 Windows:
RO59358

CA Service Desk Manager 12.6 Sun:
RO59360

CA Service Desk Manager 12.6 AIX:
RO59362

CA Service Desk Manager 12.6 Linux:
RO59359

CA Service Desk Manager 12.7 Windows:
RO59560

CA Service Desk Manager 12.7 Sun:
RO59366

CA Service Desk Manager 12.7 AIX:
RO59367

CA Service Desk Manager 12.7 Linux:
RO59365

References

CVE-2013-2630

Acknowledgement

CVE-2013-2630 - Puneeth Kumar R

Change History

Version 1.0: Initial Release

If additional information is required, please contact CA Technologies Support at https://support.ca.com/.

If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team.

Chat with CA

Just give us some brief information and we'll connect you to the right CA Expert.

Our hours of availability are 8AM - 5PM CST.

All Fields Required

connecting

We're matching your request.

Unfortunately, we can't connect you to an agent. If you are not automatically redirected please click here.

  • {{message.agentProfile.name}} will be helping you today.

    View Profile


  • Transfered to {{message.agentProfile.name}}

    {{message.agentProfile.name}} joined the conversation

    {{message.agentProfile.name}} left the conversation

  • Your chat with {{$storage.chatSession.messages[$index - 1].agentProfile.name}} has ended.
    Thank you for your interest in CA.


    How Did We Do?
    Let us know how we did so that we can maintain a quality experience.

    Take Our Survey >

    Rate Your Chat Experience.

    {{chat.statusMsg}}

agent is typing