-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CA20190904-01: Security Notice for CA Common Services Distributed Intelligence Architecture (DIA) Issued: September 4th, 2019 Last Updated: September 4th, 2019 CA Technologies, A Broadcom Company, is alerting customers to a potential risk with CA Common Services in the Distributed Intelligence Architecture (DIA) component. A vulnerability exists, CVE-2019-13656, that can allow a remote attacker to execute arbitrary code. CA published solutions to address the vulnerabilities and recommends that all affected customers implement these solutions immediately. Risk Rating High Platform(s) All supported platforms Affected Products CA Common Components DIA CA Technologies products that bundle this software include: CA Client Automation 14 and later versions CA Workload Automation AE 11.3.5 and 11.3.6 How to determine if the installation is affected Customers should review the Solution section to determine whether the fix is present. CA Workload Automation Autosys: The Distributed Intelligence Architecture (DIA) that installs with the 11.3.5 and 11.3.6 C3 DVD is vulnerable. Solution CA published the following solutions to address the vulnerabilities. Fixes are available on the CA support site. CA Client Automation: Windows Solution: SO09605 Linux Solution: SO09633 CA Workload Automation Autosys: The following are the fixes published by the Workload Automation Autosys Product team for the vulnerability CVE-2019-13656 reported against Distributed Intelligence Architecture (DIA) shipped with C3 DVD. Windows Solution: SO09111 Linux Solution: SO09057 HP-UX Solution: SO09086 Solaris Solution: SO09084 AIX Solution: SO09085 Patch Validation The script applypatch.bat for Windows and applypatch.sh for Linux and Unix platforms when run should not produce any errors in its console output. The script starts the NSM services at the end of the patch application process. A successful patch application is manifested in the form of all services coming up successfully. References CVE-2019-13656 - Ca Common Services remote code execution Acknowledgement CVE-2019-13656 - Fredrik Ravne, Oslo Boers Change History Version 1.0: Initial Release CA customers may receive product alerts and advisories by subscribing to Proactive Notifications on the support site. Customers who require additional information about this notice may contact CA Technologies Support at https://casupport.broadcom.com/ To report a suspected vulnerability in a CA Technologies product, please send a summary to CA Technologies Product Vulnerability Response at ca.psirt <AT> broadcom.com Security Notices, PGP key, and disclosure policy and guidance www.ca.com/us/support/ca-support-online/documents.aspx?id=177782 Kevin Kotas CA Product Security Incident Response Team Copyright 2019 Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. Broadcom, the pulse logo, Connecting everything, CA Technologies and the CA technologies logo are among the trademarks of Broadcom. All trademarks, trade names, service marks and logos referenced herein belong to their respective companies. -----BEGIN PGP SIGNATURE----- Charset: utf-8 wsBVAwUBXXK0LLZ6yOO9o8STAQgQBgf/UeZFiw6Ha+eEfAvDIx92DE+gglGuZB20 tc1POyvgJABJGBdyqE1aV+eYoTNhEIagD54Fkl0ZMJnwR2ZrTAdOPV/pOJa/F+z9 ajAv5Oikj2I5SH4MI0Az48ApyyD6y+zQjmu8wc5LH4LfuoujAGOIqF0s6OFMB+hl B8VDvqJuNvNalEdVFhNxUHfFjxhQaN0H1G9b98Mv9bnZJ/O60+9Kczff9O6m9y7U Dfaf0pUIqnsYxUVDk2LQ/ydoLji7QtttNXBQHS9zWIjlEkj90ZMleXozYiR6IiaV NRUpynhlzmJYf9oG0hdLD7WFXStFREf7atL7QDZuL4ar/Zz7+5xEng== =1Xi9 -----END PGP SIGNATURE-----