Description
The Web Agents component in CA SiteMinder R6 before SP6 CR2 and R12 before SP3 CR2 does not properly handle multi-line headers, which allows remote authenticated users to conduct impersonation attacks and gain privileges via crafted data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.securityfocus.com/archive/1/517626/100/0/threaded ↗
- http://securityreason.com/securityalert/8227 ↗
- http://www.securityfocus.com/bid/47520 ↗
- http://www.vupen.com/english/advisories/2011/1067 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66906 ↗
- http://securitytracker.com/id?1025423 ↗
- https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B1BF29B14-C5FB-4BD3-9113-68E2426E4381%7D ↗
- http://secunia.com/advisories/44218 ↗