CA20111208-01: Security Notice for CA SiteMinder Issued: December 08, 2011 Updated: August 22, 2012 CA Technologies Support is alerting customers to a potential risk in CA SiteMinder, CA Federation Manager, CA SOA Security Manager, CA SiteMinder Secure Proxy Server, and CA SiteMinder SharePoint Agent. A vulnerability exists that can allow a malicious user to execute a reflected cross site scripting (XSS) attack. CA Technologies has issued patches to address the vulnerability. The vulnerability, CVE-2011-4054, occurs due to insufficient validation of postpreservationdata parameter input utilized in the login.fcc form. A malicious user can submit a specially crafted request to effectively hijack a victim's browser. Risk Rating Medium Platform All Affected Products CA SiteMinder R6 SP6 CR7 and earlier CA SiteMinder R12 SP3 CR8 and earlier CA Federation Manager 12.1 SP3 and earlier CA SOA Security Manager 12.1 SP3 and earlier CA SiteMinder Secure Proxy Server 12.0 SP3 and earlier CA SiteMinder Secure Proxy Server 6.0 SP3 and earlier CA SiteMinder SharePoint Agent 12.0 SP3 and earlier Non-Affected Products CA SiteMinder R6 SP6 CR8 CA SiteMinder R12 SP3 CR9 CA Federation Manager 12.1 SP3 CR00.1 CA SOA Security Manager 12.1 SP3 CR01.1 CA SiteMinder Secure Proxy Server 12.0 SP3 CR01.1 CA SiteMinder Secure Proxy Server 6.0 SP3 CR07.1 CA SiteMinder SharePoint Agent 12.0 SP3 CR0.1 How to determine if the installation is affected Check the Web Agent log or Installation log to obtain the installed release version. Note that the "webagent.log" file name is configurable by the SiteMinder administrator. Solution CA has issued patches to address the vulnerability. CA SiteMinder R6: Upgrade to R6 SP6 CR8 or later CA SiteMinder R12: Upgrade to R12 SP3 CR9 or later CA Federation Manager 12.1 SP3: Apply fix RS47435 CA SOA Security Manager 12.1 SP3: Apply fix RS47436 CA SiteMinder Secure Proxy Server 12.0 SP3: Apply fix RS47431 CA SiteMinder Secure Proxy Server 6.0 SP3: Apply fix RS47432 CA SiteMinder SharePoint Agent 12.0 SP3: Apply fix RS47433 CR releases can be found on the CA SiteMinder Hotfix/Cumulative Release page (URL may wrap): https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={5AE61E 29-C3DE-405E-9151-9EEA72D965CE}. Workaround None References CVE-2011-4054 - CA SiteMinder login.fcc XSS Acknowledgement CVE-2011-4054 - Jon Passki of Aspect Security, via CERT Change History Version 1.0: Initial Release Version 1.1: Updated R6 fix information Version 1.2: Added information for Federation Manager, SOA Security Manager, SiteMinder Secure Proxy Server, SiteMinder SharePoint Agent If additional information is required, please contact CA Technologies Support at https://support.ca.com. If you discover a vulnerability in a CA Technologies product, please report your findings to the CA Technologies Product Vulnerability Response Team. support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782 Thanks and regards, Ken Williams, Director CA Technologies Product Vulnerability Response Team CA Technologies Business Unit Operations wilja22@ca.com