PT-2011-3268 · Ca · Ca Total Defense

Andrea Micalizzi + 1 · Published 2011-04-13 · Updated 2021-04-12 · CVE-2011-1654

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CA Total Defense versions prior to r12 SE2

Description A directory traversal issue exists in the Heartbeat Web Service, allowing remote attackers to execute arbitrary code. This is achieved by using directory traversal sequences in the GUID parameter within an upload request to the "FileUploadHandler.ashx" endpoint.

Recommendations For versions prior to r12 SE2, update to r12 SE2 or later to resolve the issue. As a temporary workaround, consider restricting access to the FileUploadHandler.ashx endpoint to minimize the risk of exploitation. Avoid using the GUID parameter in the affected endpoint until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2011-1654

ZDI-11-126

Affected Products

Ca Total Defense

References · 11

• https://zerodayinitiative.com/advisories/ZDI-11-126 · Security Note
• http://vupen.com/english/advisories/2011/0977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1654 · Security Note
• http://secunia.com/advisories/44097 · Vendor Advisory
• http://securitytracker.com/id?1025353 · Note
• http://securityfocus.com/archive/1/517488/100/0/threaded · Note
• http://securityfocus.com/archive/1/517494/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66726 · Note
• http://securityfocus.com/bid/47357 · Note
• https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7BCD065CEC-AFE2-4D9D-8E0B-BE7F6E345866%7D · Note
• http://zerodayinitiative.com/advisories/ZDI-11-126 · Note