Issued: July 25, 2013

CA Technologies Support is alerting customers to a potential risk with CA Service Desk Manager. A vulnerability exists that can allow a remote attacker to conduct cross-site scripting attacks. CA Technologies published patches to address the vulnerability.

The vulnerability, CVE-2013-2630, occurs due to insufficient verification of URL query string parameters. An attacker, who can have an unsuspecting user follow a carefully constructed URL, may perform various cross-site scripting attacks.

Risk Rating

Medium

Platform

Windows, Sun, AIX, Linux

Affected Products

CA Service Desk Manager 12.5
CA Service Desk Manager 12.6
CA Service Desk Manager 12.7

How to determine if the installation is affected

Steps to identify the Service Desk Manager version and if the relevant patch is installed:

1. Navigate to the $NX_ROOT directory on the Service Desk Server.
   
   Note: NX_ROOT points to the Service Desk Manager installation directory which by default is
   "C:Program FilesCAService Desk Manager" for Windows or "/opt/CAisd/" for Solaris, Aix, and Linux.
   
   
2. Identify the Service Desk Manager application version using the following steps:
   
   
   1. Navigate to the "$NX_ROOTpdmconf" directory for Windows or "$NX_ROOT/pdmconf/" for Solaris, Aix, and Linux
   2. Locate the file with the name "version" and open it with a text editor.
   3. The version of Service Desk can be noted from the file (Example: Version r12.6).
   
   
3. Locate the file <machine_name>.his under $NX_ROOT directory.
   
   Note: The file may not exist if the Service Desk Manager server is unpatched.
   
   
4. Open the file with a text editor and locate the patch based on the matrix below for the corresponding Service Desk Manager version and operating system:
   
   R12.5:
   WINDOWS: RO59355
   LINUX: RO59356
   SUN: RO61158
   AIX: RO61159
   
   R12.6:
   WINDOWS: RO59358
   LINUX: RO59359
   SUN: RO59360
   AIX: RO59362
   
   R12.7:
   WINDOWS: RO59560
   LINUX: RO59365
   SUN: RO59366
   AIX: RO59367
   
   An example entry found in the history file:
   
   [DATE] - PTF Wizard installed RO59355 (USRD) RELEASE=12.7
   
   
5. If the corresponding patch is not installed, then the installation might be vulnerable.

Solution

CA Technologies published the following patches to address the vulnerabilities.

CA Service Desk Manager 12.5 Windows:
RO59355

CA Service Desk Manager 12.5 Sun:
RO61158

CA Service Desk Manager 12.5 AIX:
RO61159

CA Service Desk Manager 12.5 Linux:
RO59356

CA Service Desk Manager 12.6 Windows:
RO59358

CA Service Desk Manager 12.6 Sun:
RO59360

CA Service Desk Manager 12.6 AIX:
RO59362

CA Service Desk Manager 12.6 Linux:
RO59359

CA Service Desk Manager 12.7 Windows:
RO59560

CA Service Desk Manager 12.7 Sun:
RO59366

CA Service Desk Manager 12.7 AIX:
RO59367

CA Service Desk Manager 12.7 Linux:
RO59365

References

CVE-2013-2630

Acknowledgement

CVE-2013-2630 - Puneeth Kumar R

Change History

Version 1.0: Initial Release

If additional information is required, please contact CA Technologies Support at https://support.ca.com/.

If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team.