Description
The Web Agents component in CA SiteMinder R6 before SP6 CR2 and R12 before SP3 CR2 does not properly handle multi-line headers, which allows remote authenticated users to conduct impersonation attacks and gain privileges via crafted data.
References
- 20110421 CA20110420-01: Security Notice for CA SiteMinder mailing-list
- 8227 third-party-advisory
- 47520 vdb-entry
- ADV-2011-1067 vdb-entry
- siteminder-headers-spoofing(66906) vdb-entry
- 1025423 vdb-entry
- https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B1BF29B14-C5FB-4BD3-9113-68E2426E4381%7D
- 44218 third-party-advisory