CVE-2022-1292 Openssl vulnerability and Role of the RemoteEngineer Tool in Advanced Authentication

Products

• CA Strong Authentication
• CA Advanced Authentication
• CA Advanced Authentication - Risk Authentication (RiskMinder / RiskFort)
• CA Advanced Authentication - Strong Authentication (AuthMinder / WebFort)

Issue/Introduction

The RemoteEngineer tool is a legacy component found within the CA Advanced Authentication product. This folder and its associated contents are not actively used in current product operations and have no functional role in the product's runtime environment.

Details:

1. Location of the RemoteEngineer Tool:

   • The tool is typically found in the installation directory under: AdvAuth/RemoteEngineer/

2. Purpose of the Tool:

   • Historically, the RemoteEngineer tool was intended to assist with diagnostics and metrics gathering during troubleshooting.

3. Current Usage:

   • The tool is no longer utilized by the Advanced Authentication product in its standard operations.
   • It does not interact with critical processes or impact the functionality of the product.

4. Security Implications:

   • If vulnerability scanning tools detect components within the RemoteEngineer folder (e.g., libraries or binaries), these findings can generally be considered false positives for production use.

   • CVE-2022-1292 openssl vulnerabilities: 

     •   Path             : AdvAuth/RemoteEngineer/linux/libs_gui/libssl.so.1.0.0
         Reported version : 1.0.2k
         Fixed version    : 1.0.2ze

     • Path             : AdvAuth/RemoteEngineer/linux/libs_gui/libcrypto.so.1.0.0
         Reported version : 1.0.2k
         Fixed version    : 1.0.2ze

Environment

 CA Advanced Authentication 9.x

Resolution

Recommendations:

• Retention:

  • The folder can remain on the server without any risk to the product's operation, as it is inactive and not invoked during runtime.

• Removal:

  • If security or compliance teams are concerned, the folder can be safely removed without any impact on Advanced Authentication functionality.

• Exemptions:

  • Customers may also choose to add the folder to their exception list during vulnerability scans, as the tool is not used in live environments.

Frequently Asked Questions (FAQ):

Q1: Will removing the RemoteEngineer folder impact Advanced Authentication operations?
No, the removal of this folder and its contents will not affect the functionality of the product.

Q2: Why does the folder remain in the installation directory?
The folder remains due to legacy packaging and is not actively maintained or used in newer product versions.

Q3: What should I do if vulnerabilities are reported in components within this folder?
You can safely remove the folder or add it to the exclusion list in your vulnerability scanning tool.

Support Contact:

For additional questions or assistance, please contact Broadcom Support. You can open the case through our support portal at https://support.broadcom.com.