Subject: CA20090615-02: CA Service Desk Tomcat Cross Site Scripting Vulnerability
Date: Tue, 16 Jun 2009 08:05:26 -0400
Message-ID: <649CDCB56C88AA458EFF2CBF494B6204071FCBA7@USILMS12.ca.com.>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: CA20090615-02: CA Service Desk Tomcat Cross Site Scripting Vulnerability
Thread-Index: AcnuervkB/hBt/d2R+ODAXWqMMINqQ==
From: "Williams, James K" <James.Williams@ca.com.>
To: <bugtraq@securityfocus.com.>
X-OriginalArrivalTime: 16 Jun 2009 12:05:54.0080 (UTC) FILETIME=[CC7AF200:01C9EE7A]
X-Virus-Scanned: antivirus-gw at tyumen.ru
Title: CA20090615-02: CA Service Desk Tomcat Cross Site Scripting=20
Vulnerability
CA Advisory Reference: CA20090615-02
CA Advisory Date: 2009-06-15
Impact: A remote attacker can inject arbitrary web script or HTML.
Summary: The release of Tomcat as included with CA Service Desk=20
r11.2 is potentially susceptible to a cross-site scripting=20
vulnerability. CA has issued a technical document that describes=20
remediation procedures.
Mitigating Factors: None
Severity: CA has given this vulnerability a Medium risk rating.
Affected Products:
CA Service Desk r11.2
Affected Platforms:
Windows, Unix
Status and Recommendation:
Follow the instructions in technical document TEC489643.
https://support.ca.com/irj/portal/anonymous/\
redirArticles?reqPage=3Dsearch&searchID=3DTEC489643
How to determine if the installation is affected:
Customers can use the instructions in technical document TEC489643=20
to determine if an installation may be affected.
Workaround:=20
None
References (URLs may wrap):
CA Support:
https://support.ca.com/
CA20090615-02: Security Notice for CA Service Desk
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=3D209=
5
00
Solution Document Reference APARs:
TEC489643
CA Security Response Blog posting:
CA20090615-02: CA Service Desk Tomcat Cross Site Scripting=20
Vulnerability
community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15.aspx
CVE References:
CVE-2008-1232
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-1232
OSVDB References: Pending
http://osvdb.org/
Changelog for this advisory:
v1.0 - Initial Release
Customers who require additional information should contact CA
Technical Support at https://support.ca.com.
For technical questions or comments related to this advisory,=20
please send email to vuln AT ca DOT com.
If you discover a vulnerability in CA products, please report your=20
findings to the CA Product Vulnerability Response Team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=3D177=
7
82
Regards,
Ken Williams, Director ; 0xE2941985
CA Product Vulnerability Response Team
CA, 1 CA Plaza, Islandia, NY 11749
=09
Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2009 CA. All rights reserved.
