CA Siteminder login.fcc form xss vulnerability

Overview

CA Siteminder R6 SP6 CR7, R12 SP3 CR8 and possibly previous versions, are vulnerable to a reflective cross site scripting (XSS) vulnerability.

Description

According to CA’s website: “CA SiteMinder provides a centralized security management foundation that enables the secure use of the web to deliver applications and cloud services to customers, partners, and employees.” CA Siteminder software fails to sanitize POST requests sent to the login.fcc form. As a result, stored and reflective cross site scripting (XSS) attacks can be conducted. An attacker can inject javascript code that will be run each time the specified webpage is accessed by inserting javascript code in the affected parameter. According to the reporter the login.fcc webpage and postpreservationdata parameter is affected by a reflective XSS vulnerability, postpreservationdata=fail&target="><script>alert(1)</script><"

---

Impact

An attacker with access to the CA Siteminder can conduct a cross site scripting attack, which could be used to result in information leakage, privilege escalation, and/or denial of service.

---

Solution

The vendor has confirmed that this vulnerability has been addressed in SiteMinder R6 SP6 CR8 and SiteMinder R12 SP3 CR9.

---

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS or CSRF attacks since the attack comes as an HTTP request from a legitimate user’s host. Restricting access would prevent an attacker from accessing a CA Siteminder using stolen credentials from a blocked network location.

---

Vendor Information

713012

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Computer Associates __ Affected

Notified: October 05, 2011 Updated: December 09, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has confirmed that this vulnerability has been address in SiteMinder R6 SP6 CR8 and SiteMinder R12 SP3 CR9.

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

<http://www.ca.com/us/web-access-management.aspx&gt;

Acknowledgements

Thanks to Jon Passki of Aspect Security for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:	CVE-2011-4054
Severity Metric:	0.14 Date Public: