----------------------------------------------------------------------

Did you know that a change in our assessment rating, exploit code
availability, or if an updated patch is released by the vendor, is
not part of this mailing-list?

Click here to learn more:
http://secunia.com/advisories/business_solutions/

----------------------------------------------------------------------

TITLE:
CA Service Level Management / Service Metric Analysis Command
Execution

SECUNIA ADVISORY ID:
SA33430

VERIFY ADVISORY:
http://secunia.com/advisories/33430/

CRITICAL:
Moderately critical

IMPACT:
System access

WHERE:
>From local network

SOFTWARE:
CA Unicenter Service Level Management 3.x
http://secunia.com/advisories/product/5595/
CA Unicenter Service Metric Analysis 11.x
http://secunia.com/advisories/product/7126/

DESCRIPTION:
A vulnerability has been reported in CA Service Level Management
(SLM) and CA Service Metric Analysis (SMA), which can be exploited by
malicious people to compromise a vulnerable system.

The vulnerability is caused due to insecure access restrictions
associated with the "smmsnmpd" service and can be exploited to
execute arbitrary commands in the context of the service.

The vulnerability is reported in the following products:
CA Service Level Management 3.5
CA Service Metric Analysis r11.0
CA Service Metric Analysis r11.1
CA Service Metric Analysis r11.1 SP1

SOLUTION:
Apply the patches.

CA Service Level Management 3.5:
Apply RO04649.
https://support.ca.com/irj/portal/anonymous/redirArticles?reqPage=search&searchID=RO04649

CA Service Metric Analysis r11.0:
Apply RO04653.
https://support.ca.com/irj/portal/anonymous/redirArticles?reqPage=search&searchID=RO04653

CA Service Metric Analysis r11.1, CA Service Metric Analysis r11.1
SP1:
Apply RO04667.
https://support.ca.com/irj/portal/anonymous/redirArticles?reqPage=search&searchID=RO04667

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Michel Arboi of Tenable Network Security.

ORIGINAL ADVISORY:
CA20090107-01:
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=196148

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------