PT-2011-3268 · Ca · Ca Total Defense

Andrea Micalizzi + 1 · Publicado 2011-04-13 · Atualizado 2021-04-12 · CVE-2011-1654

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CA Total Defense versions prior to r12 SE2

Description A directory traversal issue exists in the Heartbeat Web Service, allowing remote attackers to execute arbitrary code. This is achieved by using directory traversal sequences in the GUID parameter within an upload request to the "FileUploadHandler.ashx" endpoint.

Recommendations For versions prior to r12 SE2, update to r12 SE2 or later to resolve the issue. As a temporary workaround, consider restricting access to the FileUploadHandler.ashx endpoint to minimize the risk of exploitation. Avoid using the GUID parameter in the affected endpoint until the issue is resolved.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2011-1654

ZDI-11-126

Produtos afetados

Ca Total Defense

Referências · 11

• http://securitytracker.com/id?1025353 · Nota
• http://securityfocus.com/archive/1/517488/100/0/threaded · Nota
• http://securityfocus.com/archive/1/517494/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66726 · Nota
• https://zerodayinitiative.com/advisories/ZDI-11-126 · Nota de Segurança
• http://securityfocus.com/bid/47357 · Nota
• http://vupen.com/english/advisories/2011/0977 · Aviso do Fabricante
• https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7BCD065CEC-AFE2-4D9D-8E0B-BE7F6E345866%7D · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1654 · Nota de Segurança
• http://secunia.com/advisories/44097 · Aviso do Fabricante
• http://zerodayinitiative.com/advisories/ZDI-11-126 · Nota