(CA Issues Fix for CA Service Desk) Tomcat Input Validation Hole in HttpServletResponse.sendError() Permits Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1022409 |
|
SecurityTracker URL: http://securitytracker.com/id/1022409
|
|
CVE Reference:
CVE-2008-1232
(Links to External Site)
|
Date: Jun 16 2009
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): r11.2
|
Description:
A vulnerability was reported in Tomcat. A remote user can conduct cross-site scripting attacks. CA Service Desk is affected.
The HttpServletResponse.sendError() function does not properly filter HTML code from user-supplied input before displaying the input on an error page. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Tomcat software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Konstantin Kolinko reported this vulnerability.
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Tomcat software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution:
CA has issued a fix for CA Service Desk, which is affected by this vulnerability.
The CA advisory is available at:
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=209500
|
Vendor URL: tomcat.apache.org/security.html (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Red Hat Enterprise), Linux (SuSE), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (2000), Windows (2003)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 16 Jun 2009 08:05:26 -0400
Subject: CA20090615-02: CA Service Desk Tomcat Cross Site Scripting Vulnerability
|
Title: CA20090615-02: CA Service Desk Tomcat Cross Site Scripting
Vulnerability
CA Advisory Reference: CA20090615-02
CA Advisory Date: 2009-06-15
Impact: A remote attacker can inject arbitrary web script or HTML.
Summary: The release of Tomcat as included with CA Service Desk
r11.2 is potentially susceptible to a cross-site scripting
vulnerability. CA has issued a technical document that describes
remediation procedures.
Mitigating Factors: None
Severity: CA has given this vulnerability a Medium risk rating.
Affected Products:
CA Service Desk r11.2
Affected Platforms:
Windows, Unix
Status and Recommendation:
Follow the instructions in technical document TEC489643.
https://support.ca.com/irj/portal/anonymous/\
redirArticles?reqPage=search&searchID=TEC489643
How to determine if the installation is affected:
Customers can use the instructions in technical document TEC489643
to determine if an installation may be affected.
Workaround:
None
References (URLs may wrap):
CA Support:
https://support.ca.com/
CA20090615-02: Security Notice for CA Service Desk
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=2095
00
Solution Document Reference APARs:
TEC489643
CA Security Response Blog posting:
CA20090615-02: CA Service Desk Tomcat Cross Site Scripting
Vulnerability
community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15.aspx
CVE References:
CVE-2008-1232
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1232
OSVDB References: Pending
http://osvdb.org/
Changelog for this advisory:
v1.0 - Initial Release
Customers who require additional information should contact CA
Technical Support at https://support.ca.com.
For technical questions or comments related to this advisory,
please send email to vuln AT ca DOT com.
If you discover a vulnerability in CA products, please report your
findings to the CA Product Vulnerability Response Team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1777
82
Regards,
Ken Williams, Director ; 0xE2941985
CA Product Vulnerability Response Team
CA, 1 CA Plaza, Islandia, NY 11749
Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2009 CA. All rights reserved.
|
|
