Issued: September 30th, 2019

Last Updated: October 1, 2019

CA Technologies, a Broadcom Company, is alerting customers to a potential risk with CA Network Flow Analysis. A vulnerability exists that can allow a remote attacker to execute arbitrary commands. CA published a solution to address the vulnerabilities and recommends that all affected customers implement this solution.

The vulnerability, CVE-2019-13658, occurs due to default credentials and a configuration weakness. A malicious actor may use the default credentials and exploit a weakness in the configuration to execute arbitrary commands on the CA Network Flow Analysis server.

Risk Rating

High

Platform(s)

All supported platforms

Affected Products

CA Network Flow Analysis 10.0.x

CA Network Flow Analysis 9.x

How to determine if the installation is affected

Customers may use the product version to determine if their product installation is affected.

Solution

The following solution is available to address the vulnerability. Note that the typical deployment of CA Network Flow Analysis is in an internal network and system administrators should restrict access to sensitive ports (see Firewall Configuration) on the CA Network Flow Analysis server.

CA Network Flow Analysis 9.x and 10.0.x:

Customers should update to CA Network Flow Analysis 10.0.2 or later and change the MySQL passwords as described at Configure MySQL User Password.

References

CVE-2019-13658 - CA Network Flow Analysis default credentials

Acknowledgement

CVE-2019-13658 - Hendrik Van Belleghem

Change History

Version 1.0: 2019-09-30 - Initial Release

Version 2.0: 2019-10-01 - Clarified affected releases

CA customers may receive product alerts and advisories by subscribing to Proactive Notifications.

Customers who require additional information about this notice may contact CA Technologies Support at https://casupport.broadcom.com/.

To report a suspected vulnerability in a CA Technologies product, please send a summary to the CA Technologies Product Vulnerability Response Team.