CA20170126-01: Security Notice for CA Common Services casrvc

Issued: January 26, 2017
Last Updated: January 26, 2017

CA Technologies support is alerting customers to a vulnerability that may allow a local attacker to gain additional privileges with products using CA Common Services running on the AIX, HP-UX, Linux, and Solaris platforms. The vulnerability, CVE-2016-9795, occurs due to insufficient validation by the casrvc program. A local unprivileged user can exploit the vulnerability to modify arbitrary files, which can potentially allow a local attacker to gain root level access.

Risk Rating

Medium

Platform(s)

AIX, HP-UX, Linux, Solaris

Affected Products

CA Common Services

Products that include CA Common Services:

CA Client Automation 12.8, 12.9, 14.0
CA SystemEDGE 5.8.2, 5.9
CA Systems Performance for Infrastructure Managers 12.8, 12.9
CA Universal Job Management Agent 11.2
CA Virtual Assurance for Infrastructure Managers 12.8, 12.9
CA Workload Automation AE 11, 11.3, 11.3.5, 11.3.6

Unaffected Products

CA Common Services for z/OS
CA Common Services on the Windows platform

How to determine if the installation is affected

Customers may use the applyptf or equivalent program to determine if the patch from the solution section is present.

Solution

CA technologies published a fix to resolve the vulnerability for all affected products.

CA Client Automation
CA SystemEDGE
CA Systems Performance for Infrastructure Managers
CA Universal Job Management Agent
CA Virtual Assurance for Infrastructure Managers
CA Workload Automation AE

Install the following fix for CA Common Services on AIX, HP-UX, Linux, or Solaris:

RO93360

References

CVE-2016-9795 - CA Common Services casrvc local privilege escalation

Acknowledgement

CVE-2016-9795 - Craig Blackie, NCC Group

Change History

Version 1.0: Initial Release

A notification about this security notice will be sent to customers who are subscribed to Proactive Notifications.

If additional information is required, please contact CA Technologies Support at http://support.ca.com/.

If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team.

Chat with CA

Just give us some brief information and we'll connect you to the right CA ExpertCA sales representative.

Our hours of availability are 8AM - 5PM CST.

All Fields Required

connecting

We're matching your request.

Unfortunately, we can't connect you to an agent. If you are not automatically redirected please click here.

  • {{message.agentProfile.name}} will be helping you today.

    View Profile


  • Transfered to {{message.agentProfile.name}}

    {{message.agentProfile.name}} joined the conversation

    {{message.agentProfile.name}} left the conversation

  • Your chat with {{$storage.chatSession.messages[$index - 1].agentProfile.name}} has ended.
    Thank you for your interest in CA.


    Rate Your Chat Experience.

    {{chat.statusMsg}}

agent is typing