Computer Associates Arcot WebFort VAS Unspecified URI Redirection Vulnerability

Bugtraq ID:	47588
Class:	Input Validation Error
CVE:	CVE-2011-1826
Remote:	Yes
Local:	No
Published:	Apr 26 2011 12:00AM
Updated:	Apr 26 2011 12:00AM
Credit:	Daniel Stirnimann, Compass Security AG
Vulnerable:	Computer Associates Arcot WebFort Versatile Authentication Server (VAS) 6.2 Arcot Arcot 5.7 Arcot Arcot 5.2
Not Vulnerable:	Computer Associates Arcot WebFort Versatile Authentication Server (VAS) 6.2.5

Computer Associates Arcot WebFort VAS Unspecified URI Redirection Vulnerability

Computer Associates Arcot WebFort Versatile Authentication Server (VAS) is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting user follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are also possible.

Versions prior to Arcot WebFort VAS 6.2.5 are vulnerable.

Computer Associates Arcot WebFort VAS Unspecified URI Redirection Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Computer Associates Arcot WebFort VAS Unspecified URI Redirection Vulnerability

Solution:
Updates are available. Please see the references for more information.

Computer Associates Arcot WebFort VAS Unspecified URI Redirection Vulnerability

References:

• CA Homepage (Computer Associates)
  
• CA20110426-01: Security Notice for CA Arcot WebFort Versatile Authentication Ser (Computer Associates)