PT-2017-18312 · Ca · Ca Client Automation

Published 2017-05-06 · Updated 2019-10-03 · CVE-2017-8391

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CA Client Automation versions r12.9 through r14.0 SP1

Description The issue allows local users to obtain sensitive information by reading a local file that contains an encrypted password after operating system installation. This occurs because the OS Installation Management component places the encrypted password into a readable local file during the installation process.

Recommendations For CA Client Automation versions r12.9 through r14.0 SP1, consider restricting access to the local file that contains the encrypted password to minimize the risk of exploitation. As a temporary workaround, limit local user privileges to prevent them from reading the sensitive file until a fix is available.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-8391

Affected Products

Ca Client Automation

References · 5

• https://ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20170504-01-security-notice-for-ca-client-automation-os-installation-mgmt.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8391 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8391 · Security Note
• http://securityfocus.com/bid/98344 · Note
• http://securitytracker.com/id/1038410 · Note