Title: CAID 34876: CA CleverPath Portal Session Inheritance Vulnerability CA Vulnerability ID (CAID): 34876 CA Advisory Date: 2006-12-19 Discovered By: CA customer and CA Technical Support Impact: Remote attackers can potentially gain access to a user's Portal session. Summary: CA CleverPath Portal and other CA solutions that embed Portal technology contain a session verification vulnerability. In certain multiple Portal server configurations, a user who connects through one Portal server could conceivably inherit the Portal session and associated security authentication of a user running on another Portal server. Mitigating Factors: This problem only occurs when multiple Portal servers are sharing a common data store, and two of the Portal servers are started at exactly the same time. Typically, customers deploy multiple Portal servers in this type of configuration to utilize high-availability failover and load balancing. A multi CleverPath Portal server environment is not a default deployment, but it is an optional post installation configuration. None of the CA solutions that embed the Portal technology install into this scenario, or offer a multiple Portal server environment as a configurable option. However, it is conceivable that a knowledgeable administrator could have modified an embedded Portal environment to leverage multiple Portal servers. Severity: CA has given this vulnerability a Low risk rating. Affected Products: CleverPath Portal r4.51 CleverPath Portal r4.7 CleverPath Portal r4.71 BrightStor Portal r11.1 CleverPath Aion BPM r10 CleverPath Aion BPM r10.1 CleverPath Aion BPM r10.2 eTrust Security Command Center r1 eTrust Security Command Center r8 Unicenter Asset and Portfolio Management r11 Unicenter Database Management Portal r11 Unicenter Database Command Center r11.1 Unicenter Enterprise Job Manager r1 SP3 Unicenter Workload Control Center r1 SP4 Unicenter Management Portal r2.0 Unicenter Management Portal r3.1 Unicenter Management Portal r11.0 Affected platforms: All supported operating systems (Windows, Linux, and supported UNIX platforms). Status and Recommendation: The most prudent course of action for affected customers is to download and apply the corrective maintenance. If the maintenance cannot be applied right away, CA Technical Support recommends implementing interim operational process controls to ensure, when multiple Portal servers are sharing a common data store, that the server start times are duly staggered by at least one minute. Determining if you are affected: Affected Portal installations must meet both of the following criteria: 1) You are not at Portal maintenance version 4.71.001_179_060830 or higher. To determine your portal version: a. Login as a Portal Administrator. b. Choose "My Profile" from the upper right-hand portion of the main workplace. c. Click on the "Portal Administration" link. d. The Portal version will be displayed in the right-hand pane under Statistics. 2) You are running CA's Portal technology in a multi-server environment. To determine if you are running a multi-server environment: a. Login as a Portal Administrator. b. Choose "My Profile" from the upper right-hand portion of the main workplace. c. Click on the "Portal Administration" link. d. If the "Jump to Portal" menu appears in the left Portal Administration pane, you are using a multiple-server environment. If you do not see the "Jump to Portal" section, then Portal is not running in a multi-server environment and is not affected by this vulnerability. Note: refer to the SupportConnect Security Notice for additional information. References (URLs may wrap): CA SupportConnect: http://supportconnect.ca.com/ CA SupportConnect security notice for this vulnerability: Important Security Notice for CA CleverPath and Embedded Portal Customers http://supportconnectw.ca.com/public/ca_common_docs/cpportal_secnot.asp Solution Document Reference APARs: Refer to the SupportConnect Security Notice. CA Security Advisor posting: CA CleverPath Portal Session Inheritance Vulnerability http://www3.ca.com/securityadvisor/newsinfo/ CAID: 34876 CAID Advisory link: http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34876 CVE Reference: CVE-2006-6641 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6641 OSVDB Reference: OSVDB-30854 http://osvdb.org/30854 Changelog for this advisory: v1.0 - Initial Release Customers who require additional information should contact CA Technical Support at http://supportconnect.ca.com. For technical questions or comments related to this advisory, please send email to vuln@xxxxxx, or contact me directly. If you discover a vulnerability in CA products, please report your findings to vuln@xxxxxx, or utilize our "Submit a Vulnerability" form. URL: http://www3.ca.com/securityadvisor/vulninfo/submit.aspx Regards, Ken Williams ; 0xE2941985 Director, CA Vulnerability Research CA, One CA Plaza. Islandia, NY 11749 Contact http://www3.ca.com/contact/ Legal Notice http://www3.ca.com/legal/ Privacy Policy http://www3.ca.com/privacy/ Copyright © 2006 CA. All rights reserved.