Title: [CAID 35145]: CA eTrust Admin Privilege Escalation
Vulnerability
CA Vuln ID (CAID): 35145
CA Advisory Date: 2007-03-08
Impact: Attackers can gain escalated privileges.
Summary: The CA eTrust Admin GINA component contains a privilege
escalation vulnerability within the reset password interface.
Mitigating Factors: This vulnerability is exploitable only
through physical interactive access or through Remote Desktop.
Severity: CA has given this vulnerability a Medium risk rating.
Affected Products:
eTrust Admin 8.1 SP2 (8.1.2)
eTrust Admin 8.1 SP1 (8.1.1)
eTrust Admin 8.1 (8.1.0)
Affected Platforms:
Windows
Status and Recommendation:
CA has issued an update to correct the vulnerability. Two update
options are available for CA eTrust Admin 8.1 SP2 (8.1.2),
8.1 SP1 (8.1.1), 8.1 (8.1.0):
How to determine if the installation is affected:
References (URLs may wrap):
CA SupportConnect:
http://supportconnect.ca.com/
CA SupportConnect security notice for this vulnerability:
Security Notice for CA eTrust Admin GINA
http://supportconnectw.ca.com/public/etrust/etrustadmin-dmo/infodocs/etrust_secnot_gina.asp
CA Security Advisor posting:
CA eTrust Admin Privilege Escalation Vulnerability
http://www3.ca.com/securityadvisor/newsinfo/collateral.aspx?cid=101038
CAID: 35145
CAID advisory link:
http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=35145
CVE Reference: CVE-2007-1345
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1345
OSVDB Reference: OSVDB ID: 32722
http://osvdb.org/32722
Changelog for this advisory:
v1.0 - Initial Release
Customers who require additional information should contact CA
Technical Support at http://supportconnect.ca.com.
For technical questions or comments related to this advisory,
please send email to vuln AT ca DOT com.
If you discover a vulnerability in CA products, please report
your findings to vuln AT ca DOT com, or utilize our "Submit a
Vulnerability" form.
URL: http://www3.ca.com/securityadvisor/vulninfo/submit.aspx
Regards,
Ken Williams ; 0xE2941985
Director, CA Vulnerability Research
CA, One CA Plaza. Islandia, NY 11749
Contact http://www3.ca.com/contact/
Legal Notice http://www3.ca.com/legal/
Privacy Policy http://www3.ca.com/privacy/
Copyright (c) 2007 CA. All rights reserved.