Change Download Preference


{{errorInSavingPref}}
Current Preference
{{dwnldPreference}}
Change Preference to:

CA20130213-01: Security Notice for CA ControlMinder

Issued: February 13, 2013
Last updated: April 29, 2013

CA Technologies support is alerting customers to a potential risk with CA ControlMinder. A vulnerability exists that can allow a remote attacker to execute arbitrary code. CA has issued remediation to address the vulnerability.

The vulnerability, CVE-2010-0738, occurs due to the default JBoss Application Server configuration not correctly enforcing authentication. A remote attacker can bypass authentication, which may result in arbitrary code execution and server compromise. This vulnerability only affects the server components.

Important: Technical document TEC559568 now contains updated instructions for all affected products. Customers should apply the latest configuration changes from TEC559568 to fully resolve this vulnerability.

Risk Rating

High

Platform

Windows
Linux
Solaris

Affected Products

CA ControlMinder for Windows 12.5, 12.6, 12.6 SP1 (formerly CA Access Control)
CA ControlMinder for Linux 12.5, 12.6, 12.6 SP1
CA ControlMinder SAM 12.5, 12.6, 12.6 SP1
CA ControlMinder Upgrade 12.6
CA ControlMinder for Virtual Environments 2.0

Non-Affected Products

CA ControlMinder for Windows 12.7
CA ControlMinder for Linux 12.7

How to determine if the installation is affected

Review the instructions from TEC559568 to determine whether the configuration changes are implemented for affected releases.

Solution

CA Technologies has issued the following remediation to address the vulnerability.

All updates are available through the Download Center on the CA Technologies support website.

Note: CA ControlMinder 12.7 for Windows and Linux are not affected.

For CA ControlMinder on all platforms, update as follows:

CA ControlMinder for Windows 12.6:
CA ControlMinder Premium Edition 12.6 SP1 Server Components for Windows
DVD06135111E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder for Linux 12.6:
CA ControlMinder Premium Edition 12.6 SP1 Server Components for Linux
DVD06134958E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder SAM 12.6:
CA ControlMinder Premium Edition 12.6 SP1 Server Components for Linux
DVD06134958E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder Upgrade 12.6:
CA ControlMinder Premium Edition 12.6 SP1 Server Components for Linux
DVD06134958E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder for Virtual Environments 2.0:
Access Control for Virtual Environments 2.0 CR
DVD01091214E.iso
Also apply the configuration changes for 12.6 from TEC559568.

CA ControlMinder 12.5 all releases on all platforms:
Follow the instructions for 12.5 in TEC559568.

Workaround

See TEC559568 for instructions on how to properly enable authentication.

References

CVE-2010-0738

Acknowledgement

Sanehdeep Singh, Jainam Technologies Pvt. Ltd.

Change History

Version 1.0: Initial Release
Version 1.1: 2013-04-29 Added 12.6 SP1 to Affected Products, updated the Non-Affected products list, added additional fix information for all releases in the Solution section, updated the description to state customers should implement the latest recommended configuration changes, and modified the How to determine the installation is affected section.

If additional information is required, please contact CA Technologies Support at https://support.ca.com/.

If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team.