PT-2011-3269 · Ca · Ca Total Defense

Andrea Micalizzi + 1 · Publicado 2011-04-13 · Atualizado 2021-04-12 · CVE-2011-1655

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CA Total Defense versions prior to r12 SE2

Description The issue allows remote attackers to obtain database credentials by sniffing the network, due to the management.asmx module in the Management Web Service sending a cleartext response to getDBConfigSettings requests. This could subsequently enable the execution of arbitrary code.

Recommendations For versions prior to r12 SE2, update to r12 SE2 or later to resolve the issue. As a temporary workaround, consider restricting access to the management.asmx module to minimize the risk of exploitation. Avoid using the getDBConfigSettings request in the affected API endpoint until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2011-1655

ZDI-11-127

Produtos afetados

Ca Total Defense

Referências · 11

• http://securitytracker.com/id?1025353 · Nota
• http://securityfocus.com/bid/47356 · Nota
• http://securityfocus.com/archive/1/517494/100/0/threaded · Nota
• http://vupen.com/english/advisories/2011/0977 · Aviso do Fabricante
• https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7BCD065CEC-AFE2-4D9D-8E0B-BE7F6E345866%7D · Nota
• http://securityfocus.com/archive/1/517492/100/0/threaded · Nota
• http://secunia.com/advisories/44097 · Aviso do Fabricante
• http://zerodayinitiative.com/advisories/ZDI-11-127 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66727 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1655 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-11-127 · Nota de Segurança