Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.1533
CA20131024-01: Security Notice for CA SiteMinder
28 October 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: CA SiteMinder
Publisher: CA
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Cross-site Scripting -- Remote with User Interaction
Resolution: Mitigation
CVE Names: CVE-2013-5968
Original Bulletin:
https://support.ca.com/irj/portal/anonymous/phpsbpldgpg
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
CA20131024-01: Security Notice for CA SiteMinder
Issued: October 24, 2013
CA Technologies Support is alerting customers to a potential
vulnerability in CA SiteMinder that can be mitigated by utilizing
existing product functionality. The vulnerability, CVE-2013-5968, can
potentially allow a remote attacker to conduct a cross-site scripting
attack and execute script in the security context of the SiteMinder
domain. Customers should review their SiteMinder deployments to
verify that the vulnerability mitigating functionality is enabled.
Risk Rating
Medium
Platform
All platforms
Affected Products
CA SiteMinder 12.51
CA SiteMinder 12.5
CA SiteMinder 12.0
CA SiteMinder 6 Web Agents
How to determine if the installation is affected
Ensure cross-site scripting checking is enabled and the BadCSSChars
setting contains the hexadecimal double quote, "%22". See the solution
section for details.
Solution
CA Technologies support is referring customers to guidance provided in
the product documentation that describes how to protect against this
vulnerability.
These instructions are derived from the CA SiteMinder Web Agent
Configuration Guide 12.5. Review the sections titled "Protect Web
Sites Against Cross-Site Scripting" and "Configure the Web Agent to
Check For Cross Site-Scripting" starting on page 65 for more
information.
1. Add the hexadecimal equivalent for the double quote character,
"%22", to the BadCSSChars setting.
Example:
BadCSSChars=3D"<,>,%22"
*Note: Setting BadCSSChars overrides the default cross-site scripting
character set. SiteMinder administrators need to carefully review the
setting to ensure all cross-site scripting characters are blocked for
their specific environment.
2. Enable cross-site scripting checking by setting CSSChecking to yes.
Example:
CSSChecking=3D"YES"
References
CVE-2013-5968 - SiteMinder CSS
CA20131024-01: Security Notice for CA SiteMinder
https://support.ca.com/irj/portal/anonymous/phpsbpldgpg
Acknowledgement
CVE-2013-5968 - Zachary Pritchard, Cigital
Change History
Version 1.0: Initial Release
If additional information is required, please contact CA Technologies
Support at http://support.ca.com/
If you discover a vulnerability in CA Technologies products, please
report your findings to the CA Technologies Product Vulnerability
Response Team:
https://support.ca.com/irj/portal/anonymous/phpsbpldgpg
Regards,
Kevin Kotas
Director, CA Technologies Product Vulnerability Response Team
Copyright (c) 2013 CA. All Rights Reserved. One CA Plaza, Islandia,
N.Y. 11749. All other trademarks, trade names, service marks, and
logos referenced herein belong to their respective companies.
- -----BEGIN PGP SIGNATURE-----
Charset: utf-8
wsBVAwUBUmk4+pI1FvIeMomJAQHQrggAogbEH7rtjUWRebSdNJFsSr991qkOqzSq
J62WfiPpO5VRxTqAEmcvrafHsK31KP8SQXmS7me7amVhcy0/m2N0WjcORmKza47B
mbvUy5qmsf/HllYFB5FiJGcUIW85SnC2zT7NyzoVNVKsoerPMZw8g72+ocueGeaT
gN0DdOkl3OzCcnc5vLXQZHMVQ/pzku2Uy4QT2YW/gI14QS1L3XcAI5r7Kd5ceIXG
iyc/r3r9J5sxgQYmUgthzKgbd6Yroj3C47qfi/YY9xgm5cWkTy4oA7DD6bwIHCx4
GxJj4ZBCIxY6mura4Wc8L90bdwo0vjifmD0tUQS/cW1gRhAatj1EiA=3D=3D
=3DaKw/
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUm2x2hLndAQH1ShLAQK8KQ/9HXL8ykZ6WawjE8V8SDoUsu6j5ARQoE3U
QXhNz5zndVUp11X7oNA0gHIJ2etiwjDqCR6tQlRr28S4FYqoUG8AxSzKocialqK7
q8sZgIMGz4YQ+XDM92bvfIcwiHSp+LSlWh+7wV2UrcIe4B/kNRiUSE233Zq1An4/
5PKuQcP/LL3xjZdGgDXIBAYLhELf3zlgPtRqYtkQDfDM4cjJtYUGeZP2EudBU//I
MqhspJCa7fuaMo3Uv7WYgaWPwuzODSCl3yWZuHYP7lUiQtt+6mY5gNCxfD0Q72bX
7d8uv3QiqQ9ai9Vl5yURvwcT24Vikgjll1Xck+JEsi39IgQlK0TNbxHbrFVttrsA
t4+KaCOb+64zoUpjrGsH7JRFElcvYnbV7x+ub12frgOapwmkp/d7OLMniTq92OFK
a12MR4m+CERELKMRXIudyVTS5ndhT2hC1s5X77xwiNwdv+e2T6LZDI5KQajpxc08
GoS1M4qVei87ANs8Miia8iApl7Vh/KQhatbKDNaNHI14t9rSwQlso3crpKN9mo7Q
Z4/Nv7WEwq3wNq2EiAZkNae7V9oWo8yag70dmEuYTJLcRvqS1zkURDqm2BJWCwO8
lRn0Y//wjewOeK4VUOMD5t4/kwAd24OTavN4FRC/yr0ef6t2tjgj1T76XCBDYSg2
rqyA6nKLwj4=
=t2Rv
-----END PGP SIGNATURE-----