-----BEGIN PGP SIGNED MESSAGE-----
CA20141103-01: Security Notice for CA Cloud Service Management
Issued: November 3, 2014
CA Technologies Support is alerting customers to four resolved vulnerabilities with CA Cloud Service Management. Four vulnerabilities existed that could potentially allow a remote attacker to access user sessions, gain sensitive information, or cause a denial of service condition. CA Technologies fixed these vulnerabilities in all production environments as part of the Cloud Service Management Summer 2014 Upgrade.
The first vulnerability, CVE-2014-8471, concerned a replay attack. An attacker would have needed access to a user's environment in order to carry out this attack.
The second vulnerability, CVE-2014-8472, involved Identity Provider authentication token verification. An attacker would have needed to manipulate a user in order to exploit this vulnerability.
The third vulnerability, CVE-2014-8473, is a cross-site request forgery vulnerability. An attacker would have needed to manipulate a user in order to exploit this vulnerability.
The fourth vulnerability, CVE-2014-8474, is an XML external entity vulnerability that could have allowed an attacker to potentially gain sensitive information or cause a denial of service condition.
Note: These vulnerabilities no longer pose any risk to customers.
CA Cloud Service Management Spring release
CA Cloud Service Management Summer 2014 Upgrade
CA Technologies addressed these vulnerabilities with the Cloud Service Management Summer 2014 Upgrade.
CVE-2014-8471 - CSM replay CVE-2014-8472 - CSM Identity Provider CVE-2014-8473 - CSM CSRF CVE-2014-8474 - CSM XXE
CVE-2014-8471, CVE-2014-8472, CVE-2014-8473, CVE-2014-8474 - Vladislav Mladenov, Julian Krautwald, Florian Feldmann and Christian Mainka (@CheariX), Security researchers at Horst Gortz Institute for IT-Security / Chair for Network and Data Security
Version 1.0: Initial Release
If additional information is required, please contact CA Technologies Support at https://support.ca.com/
If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team at email@example.com
Security Notices https://support.ca.com/irj/portal/anonymous/phpsbpldgpg
Kevin Kotas Vulnerability Response Director CA Technologies Product Vulnerability Response Team
Copyright (c) 2014 CA. All Rights Reserved. One CA Plaza, Islandia, N.Y. 11749. All other trademarks, trade names, service marks, and logos referenced herein belong to their respective companies.
-----BEGIN PGP SIGNATURE----- Version: Encryption Desktop 10.3.2 (Build 15238) Charset: utf-8
wsBVAwUBVFu+9pI1FvIeMomJAQE4NQf+ITNLgXAJt0HID9KlyZSFEzG5XRqNL8P9 UlZxKA/IahlLdSvbNZ6UmM1jTtr+hv1HQK87lWFxqARZL7YcpDUeVWbuqT3SVZCy MT0Kd1MzGPBN6E+wvRHfa0Mp/b3cPbcsVnxRZrUQc+6zM8UtXoqNiUgPsZkfreD4 KnknGnri43G100fqjFEe21ChfBHql/cHFpnz21lvZx4acdcC0WfqvBzXfDKzr/zu uKtcP4XcoAyk/zbmugPDuk8TgCBtrm69gAiwiiSMh53HsF/K9BGIJwXPjU9okamc 9heqSPk2RnN7WXL+8szadCTCXjRv5opznDTB8raEi96PqBaUOLRYrw== =rUT8 -----END PGP SIGNATURE-----