Actu
Vigil@nce : CA SiteMinder, bypassing
August 2009 by Vigil@nce
An attacker can bypass the Cross Site Scriptings protection of CA
SiteMinder.
Severity: 2/4
Consequences: data flow
Provenance: internet client
Means of attack: 2 attacks
Ability of attacker: beginner (1/4)
Confidence: unique source (2/5)
Diffusion of the vulnerable configuration: high (3/3)
Number of vulnerabilities in this bulletin: 2
Creation date: 12/08/2009
IMPACTED PRODUCTS
– CA SiteMinder
DESCRIPTION OF THE VULNERABILITY
The CA SiteMinder product contains a protection against Cross Site
Scriptings. This protection can be bypassed in two ways.
An attacker can use a null character in order to truncate the
analysis. [grav:2/4; CVE-2009-2704]
An attacker can use a non standard Unicode character (too long) to
inject filtered characters (such as "<"). [grav:2/4; CVE-2009-2705]
An attacker can therefore use a Cross Site Scriptings against a
web site protected by CA SiteMinder.
CHARACTERISTICS
Identifiers: CVE-2009-2704, CVE-2009-2705, VIGILANCE-VUL-8945
http://vigilance.fr/vulnerability/CA-SiteMinder-bypassing-8945
