CA Technologies Support is alerting customers to multiple potential risks with CA Unified Infrastructure Management. Multiple vulnerabilities exist that can allow an attacker, who has access to the network on which CA UIM is running, to run arbitrary CA UIM commands on machines where the CA UIM probes are running. An attacker can also gain access to other machines running CA UIM and access the filesystems of those machines. The first vulnerability, has a medium risk rating and concerns a hardcoded secret key, which can allow an attacker to access sensitive information. The second vulnerability has a medium risk rating and concerns a hardcoded passphrase, which can allow an attacker to access sensitive information. The third vulnerability has a high risk rating and concerns a lack of authentication, which can allow a remote attacker to conduct a variety of attacks, including file reading/writing. Affected versions include 8.5.1, 8.5, and 8.4.7.
6e99f3fdbc87760f71a42c271a8fbbfb
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
CA20180829-02: Security Notice for CA Unified Infrastructure Management
Issued: August 29, 2018
Last Updated: August 29, 2018
CA Technologies Support is alerting customers to multiple potential
risks with CA Unified Infrastructure Management. Multiple
vulnerabilities exist that can allow an attacker, who has access to
the network on which CA UIM is running, to run arbitrary CA UIM
commands on machines where the CA UIM probes are running. An attacker
can also gain access to other machines running CA UIM and access the
filesystems of those machines.
The first vulnerability, CVE-2018-13819, has a medium risk rating and
concerns a hardcoded secret key, which can allow an attacker to access
sensitive information.
The second vulnerability, CVE-2018-13820, has a medium risk rating and
concerns a hardcoded passphrase, which can allow an attacker to access
sensitive information.
The third vulnerability, CVE-2018-13821, has a high risk rating and
concerns a lack of authentication, which can allow a remote attacker
to conduct a variety of attacks, including file reading/writing.
Risk Rating
Cumulative risk rating of High.
Platform(s)
All supported platforms
Affected Products
CA Unified Infrastructure Management 8.5.1, 8.5, 8.4.7
Unaffected Products
CA Unified Infrastructure Management 8.5.1, 8.5, 8.4.7 with the
solutions listed below applied.
How to determine if the installation is affected
Review the UIM Vulnerability Patch 1 documentation [1] to determine if
all appropriate patches have been applied. Additionally, review
KB000111575: CA UIM Best Practices For Secure Environments [2] and CA
UIM Best Practices for Securing Environments to mitigate
CVE-2018-13821 [3] to ensure that all best practices have been
implemented.
Solution
Two solutions are available for CA UIM 8.5.1, CA UIM 8.5, and CA UIM
8.4.7 to resolve these vulnerabilities. Both solutions, UIM
Vulnerability Patch 1, and UIM Best Practices for Secure Environments,
must be implemented to effectively mitigate all three vulnerabilities.
* CA recommends installing UIM Vulnerability Patch 1 [1] to resolve
CVE-2018-13819 and CVE-2018-13820 as soon as possible. From the
download link, select the directory that corresponds to your release
to access the patch package.
* CA recommends securing the CA UIM deployment using the best
practices described in KB000111575: CA UIM Best Practices For Secure
Environments [2] and CA UIM Best Practices for Securing Environments
to mitigate CVE-2018-13821 [3].
- -OR-
If you feel the best practice recommendations are insufficient for
your specific security needs, please contact CA Support to install and
configure the CA UIM Secure Bus 8.01.
Note: While the secured version of the message bus has additional
security features (e.g. encrypting all UIM traffic from robot to hub),
the implementation requires additional prerequisites (such as
requiring user-provided, signed X.509 certificates) and may have
reduced functionality compared to the standard message bus.
Customers running any End of Service (EOS) release are strongly
advised to upgrade to version 8.5.1 and take the remediation actions
listed above to resolve the vulnerabilities immediately.
For the most up-to-date information about these CA Unified
Infrastructure Management vulnerabilities, and for other important
product information, please see the CA Unified Infrastructure
Management Support page [4].
References
CVE-2018-13819 - CA UIM hardcoded secret key
CVE-2018-13820 - CA UIM hardcoded passphrase
CVE-2018-13821 - CA UIM lack of authentication
[1] ftp://UIMuser:[email protected]/Important Hotfixes/UIM Vulnerability
Patch 1/
[2]
https://comm.support.ca.com/kb/ca-uim-best-practices-for-secure-environment
s/kb000111575
[3] https://support.ca.com/phpdocs/7/8384/8384-critical-alert-0716-2016.pdf
[4]
https://support.ca.com/us/product-information/ca-unified-infrastructure-man
agement.html
Acknowledgement
CVE-2018-13819 - Oystein Middelthun
CVE-2018-13820 - Oystein Middelthun
CVE-2018-13821 - Oystein Middelthun
Change History
Version 1.0: 2018-08-29 - Initial Release
Customers who require additional information about this notice may
contact CA Technologies Support at https://support.ca.com/
To report a suspected vulnerability in a CA Technologies product,
please send a summary to CA Technologies Product Vulnerability
Response at vuln <AT> ca.com
Security Notices and PGP key
support.ca.com/irj/portal/anonymous/phpsbpldgpg
www.ca.com/us/support/ca-support-online/documents.aspx?id=177782
Regards,
Ken Williams
Vulnerability Response Director, Product Vulnerability Response Team
CA Technologies | 520 Madison Avenue, 22nd Floor, New York NY 10022
Copyright (c) 2018 CA. 520 Madison Avenue, 22nd Floor, New York, NY
10022. All other trademarks, trade names, service marks, and logos
referenced herein belong to their respective companies.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 15238)
Charset: utf-8
wsFVAwUBW4lr9LlJjor7ahBNAQiHAQ/+Oa5yOCsJ6MQukur5th1zeMOyvfWE3SWX
UDY44DTe7nN3QwzyYJgBBoegxuR0UuvH1Pkd/9t26KKA7z1HD9jbRI/1TLSyRUjX
TLoMHDmmPybDPA1R3s4F92ix0B8kk0pszpLvtTcTPb8jyfuML9KlqLeKQkB4p7Dq
VuhJkm3hpWzT6ZGDqWxxWEWP5GxZbAbtFa9lyp6fm+HUOVlwo7bqqcLQ1/l4gXJD
AdVF7+/6zwW31X4llCuZbhuzqLOHb4JUbAYQG3AB3+QKHBbLs+FFVpELbnPho9gA
+8ZMtUEkLY0NNYedOZ+24SpMMF1uW9ferLwTHU7vTqDbjJ8Njyzzn3zJzGqUTgnN
9PW1eqwTtEQd2S0w7QFn3Uo+h8AKDjKfM+jSyYIOJ3seazvf7hWsIJgfMtkn69yP
N7leBnQcaIB/Gljd1k5JBGgYP+JkZBfsJToW30w87BM76GoHpqZ6Xirby03WoWEI
OGqlSCc601kQdtmnK3vMcfSIz23BDO+zDZssWMRzcmQ1abZ1BYy2/iPqVaj+60zm
sRr+t3l5n4rHVZ3PXzUQ4YcG1+lW2JEamTUycqvv7ZohRQWtCGtrhY1+8/jAYb8W
DQZiCIilEYpynjRbCVndTB9MU7Kzy/1aDBgceOiaGQ4ajbXnTXkHb2DnCrA524WC
TdSsroSnvLQ=
=5XBW
-----END PGP SIGNATURE-----