Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2007.0180 -- [Win] [CAID 35145]: CA eTrust Admin Privilege Escalation Vulnerability 20 March 2007 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: eTrust Admin 8.1 SP2 (8.1.2) eTrust Admin 8.1 SP1 (8.1.1) eTrust Admin 8.1 (8.1.0) Publisher: CA Operating System: Windows Impact: Increased Privileges Access: Existing Account CVE Names: CVE-2007-1345 Original Bulletin: http://www3.ca.com/securityadvisor/newsinfo/collateral.aspx?cid=101038 - --------------------------BEGIN INCLUDED TEXT-------------------- Title: [CAID 35145]: CA eTrust Admin Privilege Escalation Vulnerability CA Vuln ID (CAID): 35145 CA Advisory Date: 2007-03-08 Impact: Attackers can gain escalated privileges. Summary: The CA eTrust Admin GINA component contains a privilege escalation vulnerability within the reset password interface. Mitigating Factors: This vulnerability is exploitable only through physical interactive access or through Remote Desktop. Severity: CA has given this vulnerability a Medium risk rating. Affected Products: eTrust Admin 8.1 SP2 (8.1.2) eTrust Admin 8.1 SP1 (8.1.1) eTrust Admin 8.1 (8.1.0) Affected Platforms: Windows Status and Recommendation: CA has issued an update to correct the vulnerability. Two update options are available for CA eTrust Admin 8.1 SP2 (8.1.2), 8.1 SP1 (8.1.1), 8.1 (8.1.0): 1. Uninstall GINA and install 8.1 SP2 CR6 or later. Or 2. Manually replace the affected cube.exe executable with the fixed cube.exe executable from the 8.1 SP2 CR6 Manual Updates zip file. The fixed cube.exe file has a date of February 11, 2007 and a file size of 53,248 bytes. Both updates can be found at the eTrust Admin Solutions and Patches page: http://supportconnectw.ca.com/public/etrust/etrustadmin-dmo/downloads/etrustadmin-updates.asp Workaround: If patch application is not feasible at this time, ensure that Remote Desktop is disabled and restrict physical host access to reduce exposure. How to determine if the installation is affected: 1. Using Windows Explorer, locate the file "cube.exe". By default, the file is located in the "C:\Program Files\CA\eTrust Admin GINA Option" directory. 2. Right click on the file and select Properties. 3. Select the General tab. The installation is vulnerable if the creation date of cube.exe is earlier than February 11, 2007. References (URLs may wrap): CA SupportConnect: http://supportconnect.ca.com/ CA SupportConnect security notice for this vulnerability: Security Notice for CA eTrust Admin GINA http://supportconnectw.ca.com/public/etrust/etrustadmin-dmo/infodocs/etrust_secnot_gina.asp CA Security Advisor posting: CA eTrust Admin Privilege Escalation Vulnerability http://www3.ca.com/securityadvisor/newsinfo/collateral.aspx?cid=101038 CAID: 35145 CAID advisory link: http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=35145 CVE Reference: CVE-2007-1345 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1345 OSVDB Reference: OSVDB ID: 32722 http://osvdb.org/32722 Changelog for this advisory: v1.0 - Initial Release Customers who require additional information should contact CA Technical Support at http://supportconnect.ca.com. For technical questions or comments related to this advisory, please send email to vuln AT ca DOT com. If you discover a vulnerability in CA products, please report your findings to vuln AT ca DOT com, or utilize our "Submit a Vulnerability" form. URL: http://www3.ca.com/securityadvisor/vulninfo/submit.aspx Regards, Ken Williams ; 0xE2941985 Director, CA Vulnerability Research CA, One CA Plaza. Islandia, NY 11749 Contact http://www3.ca.com/contact/ Legal Notice http://www3.ca.com/legal/ Privacy Policy http://www3.ca.com/privacy/ Copyright (c) 2007 CA. All rights reserved. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRgBfnih9+71yA2DNAQK+bwP/ScyfD95aH5rATkJyimG5rBPzjAQ84jvn jB8BuyRXTBrN1Lg/mbOmnHdlO/zemziH3VNmhqo6PS9c67hlzbxAHLtZLRp/7xXx DHxg2aXtzPxJtitY+agLAG+tG/G2syzXoBQ8xz9hMWn5rDvMrvpGjPRkG/9xFbfi At5wB5yXSYg= =DIkw -----END PGP SIGNATURE-----