CA20141103-01: Security Notice for CA Cloud Service Management - CA Technologies
{{search ? 'Close':'Search'}}

CA20141103-01: Security Notice for CA Cloud Service Management

Issued: November 03, 2014

CA Technologies Support is alerting customers to four resolved vulnerabilities with CA Cloud Service Management. Four vulnerabilities existed that could potentially allow a remote attacker to access user sessions, gain sensitive information, or cause a denial of service condition. CA Technologies fixed these vulnerabilities in all production environments as part of the Cloud Service Management Summer 2014 Upgrade.

The first vulnerability, CVE-2014-8471, concerned a replay attack. An attacker would have needed access to a user's environment in order to carry out this attack.

The second vulnerability, CVE-2014-8472, involved Identity Provider authentication token verification. An attacker would have needed to manipulate a user in order to exploit this vulnerability.

The third vulnerability, CVE-2014-8473, is a cross-site request forgery vulnerability. An attacker would have needed to manipulate a user in order to exploit this vulnerability.

The fourth vulnerability, CVE-2014-8474, is an XML external entity vulnerability that could have allowed an attacker to potentially gain sensitive information or cause a denial of service condition.

Risk Rating

High

Note: These vulnerabilities no longer pose any risk to customers.

Affected Products

CA Cloud Service Management Spring release

Unaffected Products

CA Cloud Service Management Summer 2014 Upgrade

Solution

CA Technologies addressed these vulnerabilities with the Cloud Service Management Summer 2014 Upgrade.

References

CVE-2014-8471 - CSM replay
CVE-2014-8472 - CSM Identity Provider
CVE-2014-8473 - CSM CSRF
CVE-2014-8474 - CSM XXE

Acknowledgement

CVE-2014-8471, CVE-2014-8472, CVE-2014-8473, CVE-2014-8474 - Vladislav Mladenov, Julian Krautwald, Florian Feldmann and Christian Mainka (@CheariX), Security researchers at Horst Görtz Institute for IT-Security / Chair for Network and Data Security

Change History

Version 1.0: Initial Release

If additional information is required, please contact CA Technologies Support at https://support.ca.com/.

If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team.

Chat with CA

Just give us some brief information and we'll connect you to the right CA Expert.

Our hours of availability are 8AM - 5PM CST.

All Fields Required

connecting

We're matching your request.

Unfortunately, we can't connect you to an agent. If you are not automatically redirected please click here.

  • {{message.agentProfile.name}} will be helping you today.

    View Profile


  • Transfered to {{message.agentProfile.name}}

    {{message.agentProfile.name}} joined the conversation

    {{message.agentProfile.name}} left the conversation

  • Your chat with {{$storage.chatSession.messages[$index - 1].agentProfile.name}} has ended.
    Thank you for your interest in CA.


    How Did We Do?
    Let us know how we did so that we can maintain a quality experience.

    Take Our Survey >

    Rate Your Chat Experience.

    {{chat.statusMsg}}

agent is typing