[QI-3645][SG][CA PAM][MAS] RE: CA PAM - MySQL Vulnerability
Issue/Introduction:
Customer routine VAST scan flagged out that CA PAM is vulnerable to MySQL Anonymous Login Handshake Remote Information Disclosure which uses TCP 6032.
The resolution given was to upgrade to MySQL 4.0.27 / 4.1.19 / 5.0.21 / 5.1.10 or later. This cannot be done as an appliance is a hardened appliance and the customer doesn’t have access to modify any part of the application.
Cause:
This is not a Vulnerability, MySQL uses port 3306 by default. This port should not be accessible from untrusted hosts.
Environment:
Release : 3.2.x, 3.3.0 and 3.3.1
Component : PRIVILEGED ACCESS MANAGEMENT
Resolution:
The defect DE435560 has been addressed in PAM 3.3.2 and higher