ESA-2010-011: RSA, The Security Division of EMC, announces a fix for
potential security vulnerability in RSA(r) Federated Identity Manager

Security Advisory 
Updated July 20, 2010 


Summary:

RSA(r) Federated Identity Manager may be impacted by potential arbitrary
URL redirection vulnerability that may be exploited by malicious people
to bypass certain security restrictions. Security hot fix [hot fix
numbers, see below], containing the resolution to this issue, should be
applied at the earliest opportunity.



Description:

CVE Identifier: CVE-2010-2337

CVSS v2 Base Score: 6 (AV:N/AC:M/Au:S/C:P/I:P/A:P)

RSA Federated Identity Manager 4.0 and 4.1 versions contain potential
arbitrary URL redirection vulnerability that may be exploited by
malicious people to bypass certain security restrictions.

The security hot fix for RSA Federated Identity Manager available
immediately, is designed to address this potential issue. As of the date
of this RSA SecurCare(r) Online Security Advisory, RSA is not aware of
any security breaches that have occurred as a result of this
vulnerability.



Affected Products:

*RSA Federated Identity Manager 4.0
*RSA Federated Identity Manager 4.1


Recommendation:

RSA strongly recommends that all customers running RSA Federated
Identity Manager 4.0 and 4.1 versions apply following security hot
fixes, which contain the resolution to this issue, at the earliest
opportunity. In addition, RSA recommends that customers running versions
of FIM prior to 4.0 upgrade to supported software and apply the
necessary Hot fix. 

*Security Hot fix 4.0.25 for RSA Federated Identity Manager 4.0
*Security Hot fix 4.1.26 for RSA Federated Identity Manager 4.1


Common Vulnerability Scoring System (CVSS) Base Score:

The Common Vulnerability Scoring System (CVSS) Base Score for the items
identified in this advisory is 6 (AV:N/AC:M/Au:S/C:P/I:P/A:P). For more
information on CVSS scoring, please see the Knowledge Base Article,
"Security Advisories Severity Rating" at
https://knowledge.rsasecurity.com/scolcms/knowledge.aspx?solution=a46604
.



Obtaining Documentation:

To obtain RSA documentation, log on to RSA SecurCare Online at
https://knowledge.rsasecurity.com and click Products in the top
navigation menu. Select the specific product whose documentation you
want to obtain. Scroll to the section for the product version that you
want and click the set link.



Obtaining More Information:

For more information about RSA Federated Identity Manager, visit the RSA
web site at http://www.rsa.com/node.aspx?id=1191.



Getting Support and Service:

For customers with current maintenance contracts, contact your local RSA
Customer Support center with any additional questions regarding this RSA
SecurCare Note. For contact telephone numbers or e-mail addresses, log
on to RSA SecurCare Online at https://knowledge.rsasecurity.com, click
Help & Contact, and then click the Contact Us - Phone tab or the Contact
Us - Email tab.



General Customer Support Information:

http://www.rsa.com/node.aspx?id=1264



RSA SecurCare Online:

https://knowledge.rsasecurity.com



EOPS Policy:

RSA has a defined End of Primary Support policy associated with all
major versions. Please refer to the link below for additional details. 
http://www.rsa.com/node.aspx?id=2575 



SecurCare Online Security Advisories

RSA, The Security Division of EMC, distributes SCOL Security Advisories
in order to bring to the attention of users of the affected RSA products
important security information. RSA recommends that all users determine
the applicability of this information to their individual situations and
take appropriate action. The information set forth herein is provided
"as is" without warranty of any kind. RSA disclaim all warranties,
either express or implied, including the warranties of merchantability,
fitness for a particular purpose, title and non-infringement. In no
event shall RSA or its suppliers be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business
profits or special damages, even if RSA or its suppliers have been
advised of the possibility of such damages. Some states do not allow the
exclusion or limitation of liability for consequential or incidental
damages so the foregoing limitation may not apply.



About RSA SecurCare Notes & Security Advisories Subscription

RSA SecurCare Notes & Security Advisories are targeted e-mail messages
that RSA sends you based on the RSA product family you currently use. If
you'd like to stop receiving RSA SecurCare Notes & Security Advisories,
or if you'd like to change which RSA product family Notes & Security
Advisories you currently receive, log on to RSA SecurCare Online at
https://knowledge.rsasecurity.com/scolcms/help.aspx?_v=view5. Following
the instructions on the page, remove the check mark next to the RSA
product family whose Notes & Security Advisories you no longer want to
receive. Click the Submit button to save your selection.



EMC Product Security Response Center

Security_Alert@EMC.com

http://www.emc.com/contact-us/contact/product-security-response-center.h
tm