CVE-2017-9393
📋 TL;DR
This vulnerability in CA Identity Manager allows remote attackers to potentially identify passwords of locked accounts through brute-force or exhaustive search attacks. It affects CA Identity Manager versions r12.6 through r12.6 SP8, 14.0, and 14.1, exposing organizations using these versions to credential compromise risks.
💻 Affected Systems
- CA Identity Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could brute-force passwords for locked accounts, gain unauthorized access to sensitive systems, and potentially escalate privileges within the identity management infrastructure.
Likely Case
Attackers could identify passwords for some locked accounts, leading to unauthorized access to systems managed by CA Identity Manager.
If Mitigated
With proper account lockout policies and monitoring, impact is limited to failed login attempts that trigger alerts.
🎯 Exploit Status
The vulnerability enables brute-force attacks against locked accounts, which is a straightforward attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply patches from CA Security Notice CA20170921-01
Vendor Advisory: https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html
Restart Required: Yes
Instructions:
1. Download the appropriate patch from CA Support. 2. Apply the patch according to CA documentation. 3. Restart CA Identity Manager services. 4. Verify the patch is applied successfully.
🔧 Temporary Workarounds
Implement Account Lockout Policies
allConfigure strict account lockout policies to limit brute-force attempts
Network Segmentation
allRestrict access to CA Identity Manager interfaces to trusted networks only
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the CA Identity Manager interface
- Enable comprehensive logging and monitoring for failed authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check CA Identity Manager version against affected versions: r12.6 through r12.6 SP8, 14.0, and 14.1Check Version:
Check CA Identity Manager administration console or installation logs for version informationVerify Fix Applied:
Verify patch installation and check that version is no longer in vulnerable range📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts for locked accounts
- Unusual authentication patterns
Network Indicators:
- High volume of authentication requests to CA Identity Manager endpoints
SIEM Query:
source="ca_identity_manager" AND (event_type="authentication_failure" AND account_status="locked") | stats count by src_ip, user🔗 References
- http://www.securityfocus.com/bid/100956
- https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html
- http://www.securityfocus.com/bid/100956
- https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html
