CA Security Response Blog

CA20120320-01: Security Notice for CA ARCserve Backup

Kevin Kotas — Tue, 20 Mar 2012 20:49:00 GMT

Today I published a new security notice, CA20120320-01, for ARCserve Backup. The notice addresses a medium risk remotely exploitable denial of serivce vulnerability. There are no reports of exploitation in the wild at the time of this post. See below for more information. CA20120320-01: Security Notice for CA ARCserve...

CA20111208-01: Security Notice for CA SiteMinder

Ken Williams — Fri, 09 Dec 2011 12:33:00 GMT

Today we published a security notice and fixes to address a medium risk, publicly known vulnerability in CA SiteMinder. The vulnerability, CVE-2011-4054, occurs due to insufficient validation of postpreservationdata parameter input utilized in the login.fcc form. A malicious user can submit a specially crafted request to effectively hijack a victim’s browser. Vulnerability details were first...

CA20111116-01: Security Notice for CA Directory

Kevin Kotas — Wed, 16 Nov 2011 22:41:00 GMT

Today, I published a new security notice for CA Directory. The notice addresses a high risk denial of service vulnerability dealing with specially malformed SNMP packets, which was reported to us by nabCERT, National Australia Bank. At this time, we are not aware of any active exploitation. See below for details. CA20111116-01: Security Notice for CA...

CA20110809-01: Security Notice for CA ARCserve D2D

Ken Williams — Fri, 12 Aug 2011 20:25:00 GMT

On August 9, 2011, we published a security notice and fix to address a high risk vulnerability in ARCserve D2D r15. The vulnerability, CVE-2011-3011, is due to improper session handling. A remote attacker can potentially access credentials and execute arbitrary commands. Vulnerability and exploit details were originally disclosed on BugTraq on July 26, 2011, and CA was not contacted...

ARCserve D2D public disclosure of vulnerability and exploit details

Ken Williams — Tue, 26 Jul 2011 18:30:00 GMT

CA Technologies is aware of ARCserve D2D vulnerability and exploit details that were posted to BugTraq on 2011-07-26. We're currently reviewing the information and will post an update after we have completed our initial investigation. Thanks and regards, Ken Williams, Director CA Technologies Product Vulnerability Response Team CA Technologies Business Unit Operations wilja22@ca.com...