Vulnerability in OpenSSL 1.0.2zp and older in CAPKI 5.2.18 and older on SiteMinder 12.8.x Agent for Sharepoint
Article ID: 453623
Updated On:
Products
Issue/Introduction
A security scan may return a flag for the following files on the SiteMinder Sharepoint Agent r12.8.x
LINUX
/<Install_Dir>/CA/Agent-for-SharePoint/agentframework/CAPKI/CAPKI5/Linux/amd64/64/lib/libcaopenssl_ssl.so
/<Install_Dir>/CA/Agent-for-SharePoint/agentframework/CAPKI/CAPKI5/Linux/amd64/64/lib/libcaopenssl_crypto.so
WINDOWS
/<Install_Dir>\CA\Agent-for-SharePoint\agentframework\CAPKI\CAPKI5\Windows\amd64\64\lib\libcaopenssl_ssl.dll
/<Install_Dir>\CA\Agent-for-SharePoint\agentframework\CAPKI\CAPKI5\Windows\amd64\64\lib\libcaopenssl_crypto.dll
CAPKI (Previously known as ETPKI) is a C language-based Software Development Kit (SDK) that provides CA Development Community with features required to implement Information Security services in its products. CAPKI is a wrapper on OpenSSL which is robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.
Environment
PRODUCT: Symantec SiteMinder
COMPONENT: Sharepoint Agent
VERSION: r12.8.7 & r12.8.8
OPERATING SYSTEM: Windows and Linux
Cause
CAPKI (Previously known as ETPKI) is a wrapper on OpenSSL. The SiteMinder Agent for Sharepoint ships with the following versions of CAPKI:
SiteMinder Web Agent for Sharepoint 12.8.8: CAPKI 5.2.12.0
KB409254 (archived) delivered CAPKI 5.2.16
KB427906 (archived) delivered CAPKI 5.2.17
KB441111 (archived) delivered CAPKI 5.2.18
CAPKI 5.2.18 and older are compiled with versions of OpenSSL 1.0.2zp and older which have vulnerabilities (CVE's) published.
Resolution
Upgrade CAPKI to CAPKI 5.2.20 on the SiteMinder Agent for Sharepoint using this KB.
CAPKI 5.2.20 has been compiled with OpenSSL 1.0.2zq.
This solution applies to the following SiteMinder Agent for Sharepoint versions:
- r12.8.7; r12.8.8
LINUX
1) Download "etpki-install_5_2_20_linux.zip" from this KB.
2) Copy "etpki-install_5_2_20_linux.zip" to the SiteMinder Agent for Sharepoint Server on Linux and decompress it. This will create the directory /etpki-install/ in the same directory you placed "etpki-install_5_2_20_linux.zip"
3) Run the Agent for Sharepoint environment variable scripts
cd /<Install_Dir>/CA/Agent-for-SharePoint/
. ./ca_sps_env.sh
4) Verify the Agent for Sharepoint environment variables
echo $NETE_SPS_ROOT
echo $CAPKIHOME
5) Stop the Agent for Sharepoint Server
6) Change to the following directory:
cd $NETE_SPS_ROOT/agentframework/
7) Backup the '/CAPKI/' directory by renaming it '/CAPKI.BAK'
mv CAPKI CAPKI.BAK
8) Copy the '/etpki-install/' directory from "etpki-install_5_2_20_linux.zip" to $NETE_SPS_ROOT/agentframework/
9) Change to the following directory:
cd $NETE_SPS_ROOT/agentframework/etpki-install/redistrib/
10) Ensure the user has execute permissions on the installation media (setup)
11) Run the following command:
./setup install caller=spa12 instdir=$NETE_SPS_ROOT/agentframework/
12) Verify/Modify the $CAPKIHOME variable in the environment variable script:
/<Install_Dir>/CA/Agent-for-SharePoint//ca_sps_env.sh
CAPKIHOME=$NETE_SPS_ROOT/agentframework/CAPKI
export CAPKIHOME
13) Run the updated Agent for Sharepoint Environment variable script.
cd /<Install_Dir>/CA/Agent-for-SharePoint/
. ./ca_sps_env.sh
14) Start the Agent for Sharepoint Server
15) Validate Agent for Sharepoint Server functionality
16) Delete the following files:
$NETE_SPS_ROOT/agentframework/CAPKI.BAK
17) Check for the to the following directories:
/<Install_Dir>/CA/SharedComponents/CAPKI
/<Install_Dir>/CA/SC/CAPKI
NOTE: These directories may not exist in your system. If they do, you will need to determine which application is using them. If there are no other applications using these CAPKI instances, then they can be removed.
Siteminder Default: <Install_Dir>/CA/Agent-for-SharePoint/agentframework/CAPKI
Directory Server Default: <Install_Dir>/CA/Directory/dxserver/lib/capki/
WINDOWS
1) Download "etpki-install_5_2_20_win64.zip" from this KB.
2) Copy "etpki-install_5_2_20_win64.zip" to the Agent for Sharepoint Server on Windows and decompress it. This will create the directory 'etpki-install' in the same directory you placed "etpki-install_5_2_20_win64.zip"
3) Stop the Agent for Sharepoint Server
4) Change to the following directory:
<Drive>:\<Install_Dir>\CA\Agent-for-SharePoint\agentframework\ETPKI\
5) Backup the '\CAPKI\' directory by renaming it '\CAPKI.BAK\'
ren CAPKI CAPKI.BAK
6) Copy the 'etpki-install' directory from "etpki-install_5_2_20_win64.zip" to <Drive>:\<Install_Dir>\CA\Agent-for-SharePoint\agentframework\ETPKI\
7) Open a command prompt using cmd.exe as an administrator (Run As Administrator)
8) Change to the following directory:
<Drive>:\<Install_Dir>\CA\
9) Run the SiteMinder Agent for Sharepoint environment variable script
ca_sps_env.bat
10) Change to the following directory:
<Drive>:\<Install_Dir>\CA\Agent-for-SharePoint\agentframework\ETPKI\etpki-install\redistrib\
11) Run the following command:
setup.exe install caller=spa12 instdir="%NETE_SPS_ROOT%\agentframework\install\"
NOTE: This will create the following directories:
'<Drive>:\<Install_Dir>\CA\Agent-for-SharePoint\agentframework\ETPKI\CAPKI\CAPKI5\Windows\amd64\64\
12) Start the Agent for Sharepoint Server
13) Validate Agent for Sharepoint Server functionality
14) Delete the following files:
<Drive>:\<Install_Dir>\CA\Agent-for-SharePoint\agentframework\ETPKI\CAPKI.BAK
15) Check for the to the following directories:
<Install_Dir>\CA\SharedComponents\CAPKI
<Install_Dir>\CA\SC\CAPKI
NOTE: These directories may not exist in your system. If they do, you will need to determine which application is using them. If there are no other applications using these CAPKI instances, then they can be removed.
SiteMinder Agent for Sharepoint Default: <Install_Dir>\CA\secure-prox\agentframework\CAPKI
SiteMinder Policy Server Default: <Install_Dir>\CA\siteminder\CAPKI
Symantec Directory Server Default: <Install_Dir>\CA\Directory\dxserver\lib\capki/
Additional Information
SiteMinder r12.9
KB 453050 Vulnerability in OpenSSL 3.0.20 in CAPKI 6.0.3 and older on SiteMinder Access Gateway Server 12.9
KB 452920 Vulnerabilities in OpenSSL 3.0.20 delivered in CAPKI 6.0.3 bundled with SiteMinder 12.9 Policy Server
SiteMinder r12.8.8.1 and Older
KB 453623 Vulnerability in OpenSSL 1.0.2zp and older in CAPKI 5.2.18 and older on SiteMinder 12.8.x Agent for Sharepoint
KB 453596 Vulnerability in OpenSSL 1.0.2zp and older in CAPKI 5.2.18 and older on SiteMinder Web Agents
KB 453595 Vulnerability in OpenSSL 1.0.2zp and older in CAPKI 5.2.18 and older on SiteMinder Access Gateway Server 12.8.8.1 and older
KB 453434 Vulnerability in OpenSSL 1.0.2zp and older in CAPKI 5.2.18 and older on SiteMinder Policy Server Server 12.8.8.1 and older
OpenSSL 1.0.2zp within CAPKI 5.2.18 remediates the following CVE's:
CVE-2026-28388
CVE-2026-28389
CVE-2026-28390
CVE-2025-68160
CVE-2025-69421
CVE-2025-22796
CVE-2025-9230
CVE-2024-13176
CVE-2024-9143
CVE-2024-5535
CVE-2024-0727
CVE-2023-5678
CVE-2023-3817
CVE-2023-3446
CVE-2023-3817
CVE-2023-3446
CVE-2023-3817
CVE-2023-3446
CVE-2023-0465
CVE-2023-0466
CVE-2023-0464
CVE-2023-0286
CVE-2023-0215
CVE-2022-4304
CVE-2022-2068
CVE-2022-1292
CVE-2022-0778
CVE-2021-4160
CVE-2021-3712
CVE-2021-23841
CVE-2021-23840
CVE-2021-23839
CVE-2020-1971
CVE-2020-1968
CVE-2019-1551
CVE-2019-1563
CVE-2019-1547
CVE-2019-1552
CVE-2019-1559
Attachments
Feedback
