CA Single Sign-On Unspecified High-Risk Vulnerabilities Advisory

by Mike Brooks, on Mar 23, 2016 8:06:01 AM

Patch Date

March 23, 2016

Vendor

CA Technologies

Systems Affected

Version 6 - 12.52 SP2

Summary

Two high-risk vulnerabilities were discovered in the CA Technologies Single Sign-On (formerly CA SiteMinder®) application. These vulnerabilities allowed a remote attacker to cause a denial-of-service (DoS) attack or possibly gain sensitive information. We worked closely with CA Technologies in the disclosure and remediation process. Their team of engineers developed fixes that address the problems. If you’re a client of CA Technologies that relies on Single Sign-On, please visit their site for patching information.

Vendor Status

CA has been notified and have fixed the application. CVEs have been assigned to the respective vulnerabilities: CVE-2015-6853 and CVE-2015-6854.

Researcher

Mike Brooks of Bishop Fox

Vulnerabilities:Denial of Service

Comments

Vulnerability Disclosure Policy

Bishop Fox takes security issues very seriously. We believe in coordinated disclosure, and we work closely with vendors and clients to patch vulnerabilities promptly. More on our Disclosure Policy →

Subscribe to Updates