PT-2011-3318 · Ca · Ca Siteminder

Published 2011-04-27 · Updated 2021-04-12 · CVE-2011-1718

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CA SiteMinder R6 versions prior to SP6 CR2 CA SiteMinder R12 versions prior to SP3 CR2

Description The issue is related to the Web Agents component, which does not properly handle multi-line headers. This allows remote authenticated users to conduct impersonation attacks and gain privileges via crafted data.

Recommendations For CA SiteMinder R6 versions prior to SP6 CR2, update to SP6 CR2 or later to resolve the issue. For CA SiteMinder R12 versions prior to SP3 CR2, update to SP3 CR2 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-1718

Affected Products

Ca Siteminder

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2011-1718 · Security Note
• http://vupen.com/english/advisories/2011/1067 · Vendor Advisory
• http://secunia.com/advisories/44218 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1718 · Note
• http://securitytracker.com/id?1025423 · Note
• http://securityreason.com/securityalert/8227 · Note
• http://securityfocus.com/archive/1/517626/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66906 · Note
• https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B1BF29B14-C5FB-4BD3-9113-68E2426E4381%7D · Note
• http://securityfocus.com/bid/47520 · Note