PT-2017-18312 · Ca · Ca Client Automation

Publicado 2017-05-06 · Atualizado 2019-10-03 · CVE-2017-8391

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CA Client Automation versions r12.9 through r14.0 SP1

Description The issue allows local users to obtain sensitive information by reading a local file that contains an encrypted password after operating system installation. This occurs because the OS Installation Management component places the encrypted password into a readable local file during the installation process.

Recommendations For CA Client Automation versions r12.9 through r14.0 SP1, consider restricting access to the local file that contains the encrypted password to minimize the risk of exploitation. As a temporary workaround, limit local user privileges to prevent them from reading the sensitive file until a fix is available.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2017-8391

Produtos afetados

Ca Client Automation

Referências · 5

• http://securityfocus.com/bid/98344 · Nota
• https://ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20170504-01-security-notice-for-ca-client-automation-os-installation-mgmt.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-8391 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8391 · Nota de Segurança
• http://securitytracker.com/id/1038410 · Nota