-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                              ESB-2011.1230.2
   A corss site scripting vulnerability has been found in CA Siteminder.
                              29 August 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           CA Siteminder
Publisher:         Computer Associates
Operating System:  Windows
                   UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Cross-site Scripting -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2011-4054  

Original Bulletin: 
   https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={5AE61E29-C3DE-405E-9151-9EEA72D965CE}

Revision History:  August   29 2012: Added information for Federation Manager, 
                                     SOA Security Manager, SiteMinder Secure 
                                     Proxy Server, SiteMinder SharePoint Agent
                   December 12 2011: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

CA20111208-01: Security Notice for CA SiteMinder

Issued: December 08, 2011
Updated: August 22, 2012

CA Technologies Support is alerting customers to a potential risk in 
CA SiteMinder, CA Federation Manager, CA SOA Security Manager, CA 
SiteMinder Secure Proxy Server, and CA SiteMinder SharePoint Agent. A 
vulnerability exists that can allow a malicious user to execute a 
reflected cross site scripting (XSS) attack. CA Technologies has 
issued patches to address the vulnerability.

The vulnerability, CVE-2011-4054, occurs due to insufficient 
validation of postpreservationdata parameter input utilized in the 
login.fcc form. A malicious user can submit a specially crafted 
request to effectively hijack a victim's browser.

Risk Rating

Medium

Platform

All

Affected Products

CA SiteMinder R6 SP6 CR7 and earlier
CA SiteMinder R12 SP3 CR8 and earlier
CA Federation Manager 12.1 SP3 and earlier
CA SOA Security Manager 12.1 SP3 and earlier
CA SiteMinder Secure Proxy Server 12.0 SP3 and earlier
CA SiteMinder Secure Proxy Server 6.0 SP3 and earlier
CA SiteMinder SharePoint Agent 12.0 SP3 and earlier

Non-Affected Products

CA SiteMinder R6 SP6 CR8
CA SiteMinder R12 SP3 CR9
CA Federation Manager 12.1 SP3 CR00.1
CA SOA Security Manager 12.1 SP3 CR01.1
CA SiteMinder Secure Proxy Server 12.0 SP3 CR01.1
CA SiteMinder Secure Proxy Server 6.0 SP3 CR07.1
CA SiteMinder SharePoint Agent 12.0 SP3 CR0.1

How to determine if the installation is affected

Check the Web Agent log or Installation log to obtain the installed 
release version. Note that the "webagent.log" file name is 
configurable by the SiteMinder administrator.

Solution

CA has issued patches to address the vulnerability.

CA SiteMinder R6:
Upgrade to R6 SP6 CR8 or later

CA SiteMinder R12:
Upgrade to R12 SP3 CR9 or later

CA Federation Manager 12.1 SP3:
Apply fix RS47435

CA SOA Security Manager 12.1 SP3:
Apply fix RS47436

CA SiteMinder Secure Proxy Server 12.0 SP3:
Apply fix RS47431

CA SiteMinder Secure Proxy Server 6.0 SP3:
Apply fix RS47432

CA SiteMinder SharePoint Agent 12.0 SP3:
Apply fix RS47433

CR releases can be found on the CA SiteMinder Hotfix/Cumulative 
Release page (URL may wrap):
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={5AE61E29-C3DE-405E-9151-9EEA72D965CE}.

Workaround

None

References

CVE-2011-4054 - CA SiteMinder login.fcc XSS

Acknowledgement

CVE-2011-4054 - Jon Passki of Aspect Security, via CERT

Change History

Version 1.0: Initial Release
Version 1.1: Updated R6 fix information
Version 1.2: Added information for Federation Manager, SOA Security 
Manager, SiteMinder Secure Proxy Server, SiteMinder SharePoint Agent

If additional information is required, please contact CA Technologies 
Support at https://support.ca.com.

If you discover a vulnerability in a CA Technologies product, please 
report your findings to the CA Technologies Product Vulnerability 
Response Team.
support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782

Thanks and regards,
Ken Williams, Director
CA Technologies Product Vulnerability Response Team
CA Technologies Business Unit Operations
wilja22@ca.com

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUD2xEu4yVqjM2NGpAQJkuRAAhuNPsnqj/zFKF5HXp58mDayhCLv14nbP
sDwOyln4FIeVOt+7aNj9rlzGhIHzm/caFcgQZ6obQtyA76cWdmJ7zW+2KnOR0Bdw
cqiPmNWN9S5iAtlGDUpf0ag4yRxxNYiz01ulvdZokgJsf6pYDGFSYmJMAyzN107w
HzV/4yMlGx5LxIGhFsucydtYVCyhxlImKrOt8nmR7skvXX09wAUccxBcVgo+LouD
VE62Ja2pHSha2LGY0Yz29AY/tSeBC63o0AHcTG6l91XzlyLPxWNLbkGXxkOYY3Qf
G1sq2e9XHO9R34E3cUDcY2d21qUhqskaZVj4YswZnMFKUxdY/3m9mODDavppI/A1
t/OUh5NbX6YR6Ckp4Ne14+IeFjqyM68pkp2sD5TjTrqQIPdqn9/Wir81+Fl3YsFF
J2XHr8yMkllv0wO8yjCG0ckyu24pwZTpR4TRfpZZhTnJ20b8cE2xb+WehGlRvPut
Wjil5ov7rxpMN1b61HElPZYdx0OyiUJHx2rwAcZbAiwoKpnE28Ei/NPoRU5a7WxD
v1eMACsiFxlHfZa/PX6jZUKFv1w4+hbQV3QqOmKo+X+vnvk/Vl9CJIzoaC6QBqxM
Y38R+CLM6vKhquD3wP6Q0suhnku6Pin/QOY50+ztlET44MkfB9k/myjOGaK9usYS
0recPEB8QXI=
=VmyH
-----END PGP SIGNATURE-----