Change Download Preference


{{errorInSavingPref}}
Current Preference
{{dwnldPreference}}
Change Preference to:

CA20191015-01: Security Notice for CA Performance Management

Issued: October 15th, 2019

Last Updated: October 15th, 2019

CA Technologies, A Broadcom Company, is alerting customers to a potential risk with CA Performance Management. A vulnerability exists that can allow a remote attacker to execute arbitrary commands.  CA published solutions to address the vulnerabilities and recommends that all affected customers implement these solutions.

The vulnerability, CVE-2019-13657, occurs due to default credentials and a configuration weakness. A malicious actor may use the default credentials and exploit a weakness in the configuration to execute arbitrary commands on the Performance Center server.

Risk Rating

High

Platform(s)

All supported platforms

Affected Products

NetOps 19.1 and prior

Component Version(s) Affected:

CA Performance Management 3.7.x prior to 3.7.4

CA Performance Management 3.6.x prior to 3.6.9

CA Performance Management 3.5.x

How to determine if the installation is affected

Customers may use the product version to determine if their product installation is affected.

Solution

CA Technologies published the following solutions to address the vulnerabilities. Customers should also review Firewall and Connectivity Considerations in the documentation. As always we recommend that you follow good password management for all passwords within the system.

CA Performance Management 3.7.x:

Update to Performance Management 3.7.4 or later.

Review the 3.7.x upgrade steps and MySQL password guidance located here.

CA Performance Management 3.6.x:

Update to Performance Management 3.6.9 or later. Alternatively, customers may update to 3.7.4 or later.

Review the 3.6.x upgrade steps and MySQL password guidance located here.

CA Performance Management 3.5.x:

Update to Performance Management 3.7.4 or later.

Review the 3.7.x upgrade steps and MySQL password guidance located here.

For explicit 3.5.x guidance on changing the password for MySQL, review the steps located here.

References

CVE-2019-13657 - Performance Management default credentials

Acknowledgement

CVE-2019-13657 - Hendrik Van Belleghem

Change History

Version 1.0: 2019-10-15 - Initial Release

CA customers may receive product alerts and advisories by subscribing to Proactive Notifications.

Customers who require additional information about this notice may contact CA Technologies Support at https://casupport.broadcom.com/.

To report a suspected vulnerability in a CA Technologies product, please send a summary to the CA Technologies Product Vulnerability Response Team.