[CAID 34876]: CA CleverPath Portal Session Inheritance Vulnerability
Title: CAID 34876: CA CleverPath Portal Session Inheritance
Vulnerability
CA Vulnerability ID (CAID): 34876
CA Advisory Date: 2006-12-19
Discovered By: CA customer and CA Technical Support
Impact: Remote attackers can potentially gain access to a user's
Portal session.
Summary: CA CleverPath Portal and other CA solutions that embed
Portal technology contain a session verification vulnerability.
In certain multiple Portal server configurations, a user who
connects through one Portal server could conceivably inherit the
Portal session and associated security authentication of a user
running on another Portal server.
Mitigating Factors: This problem only occurs when multiple Portal
servers are sharing a common data store, and two of the Portal
servers are started at exactly the same time. Typically, customers
deploy multiple Portal servers in this type of configuration to
utilize high-availability failover and load balancing. A multi
CleverPath Portal server environment is not a default deployment,
but it is an optional post installation configuration. None of the
CA solutions that embed the Portal technology install into this
scenario, or offer a multiple Portal server environment as a
configurable option. However, it is conceivable that a
knowledgeable administrator could have modified an embedded Portal
environment to leverage multiple Portal servers.
Severity: CA has given this vulnerability a Low risk rating.
Affected Products:
CleverPath Portal r4.51
CleverPath Portal r4.7
CleverPath Portal r4.71
BrightStor Portal r11.1
CleverPath Aion BPM r10
CleverPath Aion BPM r10.1
CleverPath Aion BPM r10.2
eTrust Security Command Center r1
eTrust Security Command Center r8
Unicenter Asset and Portfolio Management r11
Unicenter Database Management Portal r11
Unicenter Database Command Center r11.1
Unicenter Enterprise Job Manager r1 SP3
Unicenter Workload Control Center r1 SP4
Unicenter Management Portal r2.0
Unicenter Management Portal r3.1
Unicenter Management Portal r11.0
Affected platforms:
All supported operating systems (Windows, Linux, and supported
UNIX platforms).
Status and Recommendation:
The most prudent course of action for affected customers is to
download and apply the corrective maintenance. If the maintenance
cannot be applied right away, CA Technical Support recommends
implementing interim operational process controls to ensure, when
multiple Portal servers are sharing a common data store, that the
server start times are duly staggered by at least one minute.
Determining if you are affected:
Affected Portal installations must meet both of the following
criteria:
1) You are not at Portal maintenance version 4.71.001_179_060830
or higher. To determine your portal version:
a. Login as a Portal Administrator.
b. Choose "My Profile" from the upper right-hand portion of the
main workplace.
c. Click on the "Portal Administration" link.
d. The Portal version will be displayed in the right-hand pane
under Statistics.
2) You are running CA's Portal technology in a multi-server
environment. To determine if you are running a multi-server
environment:
a. Login as a Portal Administrator.
b. Choose "My Profile" from the upper right-hand portion of the
main workplace.
c. Click on the "Portal Administration" link.
d. If the "Jump to Portal" menu appears in the left Portal
Administration pane, you are using a multiple-server
environment. If you do not see the "Jump to Portal" section,
then Portal is not running in a multi-server environment and
is not affected by this vulnerability.
Note: refer to the SupportConnect Security Notice for additional
information.
References (URLs may wrap):
CA SupportConnect:
http://supportconnect.ca.com/
CA SupportConnect security notice for this vulnerability:
Important Security Notice for CA CleverPath and Embedded Portal
Customers
http://supportconnectw.ca.com/public/ca_common_docs/cpportal_secnot.asp
Solution Document Reference APARs:
Refer to the SupportConnect Security Notice.
CA Security Advisor posting:
CA CleverPath Portal Session Inheritance Vulnerability
http://www3.ca.com/securityadvisor/newsinfo/
CAID: 34876
CAID Advisory link:
http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34876
CVE Reference: CVE-2006-6641
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6641
OSVDB Reference: OSVDB-30854
http://osvdb.org/30854
Changelog for this advisory:
v1.0 - Initial Release
Customers who require additional information should contact CA
Technical Support at http://supportconnect.ca.com.
For technical questions or comments related to this advisory,
please send email to vuln@xxxxxx, or contact me directly.
If you discover a vulnerability in CA products, please report
your findings to vuln@xxxxxx, or utilize our "Submit a
Vulnerability" form.
URL: http://www3.ca.com/securityadvisor/vulninfo/submit.aspx
Regards,
Ken Williams ; 0xE2941985
Director, CA Vulnerability Research
CA, One CA Plaza. Islandia, NY 11749
Contact http://www3.ca.com/contact/
Legal Notice http://www3.ca.com/legal/
Privacy Policy http://www3.ca.com/privacy/
Copyright © 2006 CA. All rights reserved.