PT-2013-3637 · Microsoft+1 · Sharepoint Server+3

Published 2013-03-21 · Updated 2018-08-13 · CVE-2013-2279

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CA SiteMinder Federation (FSS) versions 12.0 through 12.5 CA SiteMinder Federation (Standalone) versions 12.0 through 12.1 CA Agent for SharePoint 2010 CA SiteMinder for Secure Proxy Server versions 6.0 through 12.5

Description The issue concerns the improper verification of XML signatures for SAML statements, allowing remote attackers to spoof other users and gain privileges.

Recommendations For CA SiteMinder Federation (FSS) versions 12.0 through 12.5, update the software to properly verify XML signatures. For CA SiteMinder Federation (Standalone) versions 12.0 through 12.1, update the software to properly verify XML signatures. For CA Agent for SharePoint 2010, update the software to properly verify XML signatures. For CA SiteMinder for Secure Proxy Server versions 6.0 through 12.5, update the software to properly verify XML signatures.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-2279

Affected Products

Ca Agent For Sharepoint

Ca Siteminder Federation

Ca Siteminder For Secure Proxy Server

Sharepoint Server

References · 5

• http://secunia.com/advisories/52610 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2279 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2013-03/0118.html · Note
• https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B53E50CBD-6F6A-4B3A-85FF-36E44ABED8D5%7D · Note
• http://securityfocus.com/bid/58609 · Note