search menu icon-carat-right cmu-wordmark

CERT Coordination Center

CA Siteminder login.fcc form xss vulnerability

Vulnerability Note VU#713012

Original Release Date: 2011-12-07 | Last Revised: 2011-12-09

Overview

CA Siteminder R6 SP6 CR7, R12 SP3 CR8 and possibly previous versions, are vulnerable to a reflective cross site scripting (XSS) vulnerability.

Description

According to CA's website: "CA SiteMinder provides a centralized security management foundation that enables the secure use of the web to deliver applications and cloud services to customers, partners, and employees." CA Siteminder software fails to sanitize POST requests sent to the login.fcc form. As a result, stored and reflective cross site scripting (XSS) attacks can be conducted. An attacker can inject javascript code that will be run each time the specified webpage is accessed by inserting javascript code in the affected parameter. According to the reporter the login.fcc webpage and postpreservationdata parameter is affected by a reflective XSS vulnerability, postpreservationdata=fail&target="><script>alert(1)</script><"

Impact

An attacker with access to the CA Siteminder can conduct a cross site scripting attack, which could be used to result in information leakage, privilege escalation, and/or denial of service.

Solution

The vendor has confirmed that this vulnerability has been addressed in SiteMinder R6 SP6 CR8 and SiteMinder R12 SP3 CR9.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS or CSRF attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing a CA Siteminder using stolen credentials from a blocked network location.

Vendor Information

713012
 
Affected   Unknown   Unaffected

Computer Associates

Notified:  October 05, 2011 Updated:  December 09, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has confirmed that this vulnerability has been address in SiteMinder R6 SP6 CR8 and SiteMinder R12 SP3 CR9.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

Thanks to Jon Passki of Aspect Security for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs: CVE-2011-4054
Severity Metric: 0.14
Date Public: 2011-12-07
Date First Published: 2011-12-07
Date Last Updated: 2011-12-09 14:00 UTC
Document Revision: 17

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.