{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Computer Associates eTrust Audit version r8 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Computer Associates eTrust Audit version 1.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Computer Associates eTrust Security Command Center version 1.0.",
      "product": {
        "name": "Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Computer Associates eTrust Security Command Center version r8 SP1 CR1 ;",
      "product": {
        "name": "Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Computer Associates eTrust Security Command Center version r8 ;",
      "product": {
        "name": "Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Computer Associates eTrust Security Command Center version r8 SP1 CR2 ;",
      "product": {
        "name": "Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLa premi\u00e8re vuln\u00e9rabilit\u00e9 provient d\u0027une erreur dans le script\nePPIServlet qui g\u00e8re incorrectement des param\u00e8tres mal form\u00e9s. Cette\nvuln\u00e9rabilit\u00e9 permet \u00e0 des agresseurs d\u0027obtenir des informations\nrelatives \u00e0 l\u0027arborescence du syst\u00e8me cible (chemin vers le r\u00e9pertoire\nd\u0027installation).\n\nLa seconde vuln\u00e9rabilit\u00e9 provient d\u0027une erreur dans le script\neSMPAuditServlet qui valide incorrectement des param\u00e8tres. Cette\nvuln\u00e9rabilit\u00e9 permet \u00e0 des agresseurs de lire ou de d\u00e9truirte des\nfichiers arbitraires.\n\nLa troisi\u00e8me vuln\u00e9rabilit\u00e9 se trouve au niveau du syst\u00e8me de gestion des\nalertes qui est accessible sans authentification pr\u00e9alable. Cette\nvuln\u00e9rabilit\u00e9 permet \u00e0 des agresseurs d\u0027envoyer de fausses alertes.\n\n## Contournement provisoire\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2006-09-22T00:00:00",
  "last_revision_date": "2006-09-22T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de CA :",
      "url": "http://supportconnectw.ca.com/public/etrust/eTrust_scc/downloads/eTrustscc_updates.asp"
    }
  ],
  "reference": "CERTA-2006-AVI-409",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-09-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s dans des composants de Computer Associates\npermettent \u00e0 des agresseurs de contourner des r\u00e8gles de s\u00e9curit\u00e9 et\nd\u0027acc\u00e9der \u00e0 des donn\u00e9es sensibles.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans CA",
  "vendor_advisories": []
}