Sign-up

ID

VAR-201604-0426


CVE

CVE-2016-3118


TITLE

CA API Gateway In CRLF Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2016-001938

DESCRIPTION

CRLF injection vulnerability in CA API Gateway (formerly Layer7 API Gateway) 7.1 before 7.1.04, 8.0 through 8.3 before 8.3.01, and 8.4 before 8.4.01 allows remote attackers to have an unspecified impact via unknown vectors. Supplementary information : CWE Vulnerability type by CWE-93: Improper Neutralization of CRLF Sequences (CRLF injection ) Has been identified. http://cwe.mitre.org/data/definitions/93.htmlA third party may be affected unspecified. An attacker can exploit this issue to add arbitrary headers to a webpage. This may aid in further attacks. CA has fixes available. Update to the fix version indicated below. All Rights Reserved. One CA Plaza, Islandia, N.Y. 11749. All other trademarks, trade names, service marks, and logos referenced herein belong to their respective companies. -----BEGIN PGP SIGNATURE----- Charset: utf-8 wsFVAwUBVwQ4wDuotw2cX+zOAQqaNg//Q3UFXyWWwTCUWubjAJD9XKmwmQ94mN1z Z8nZlDZoAvS72F0PM9IxPs4Y135Gxw6D9mbyOjDKcF1uPaZCCAHyAjsYf+wkwLyq l8ILYq1FPchY6lbwH+nx8U+XHRG0/g+mgGjBa4jDNhItGFVidxFFm1CjPHQkbONq xifyNhkys81InM115ikkhmXEE7CORRwmrtC+kHu/vnZpHO1yw9uUQNn4M41hmW2d 3fJt9D6m5mroBa9qN4Z6Q2GrOY7yRM54mETcEa6mDvh9jtRxhIuXVVmWBG0tI0fG 9+ul46MbNb1oSUQilrrDqlZOfnUvAPhvB2nCwnnO14cuI9pgslomVsXb6L1Td7XR to6lA60Q75GxPJRC8g0OPnq5OSW1WtUf7hnq+jJh0WFHN/zoacKPZiiPilsy9xCq rV4nMEm/MAZeF8nNljn434Z6HugoPcilkjmyk4aZPsZXq43xxO2flsedEubYH8dC 6qc6tkyyAQXXuwazf7cWk+jlCafjXDqSYz70KMRhyWCqMvNXWnlHfyc4TLWxUtU1 3C9YeLsp20RS6TSDTDCpZJMZyhIRN/icg7WA/Sjoh+spV6dZ9JTCB+oXpB7wP+8V t7kcF9hW+Dh/II1OUMN/PXvH72G4M1NyaPuBhFyVsdYU97uwfVGSPBqG2NqMkBlL yBbzOtDOq6s= =rWD3 -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2016-3118 // JVNDB: JVNDB-2016-001938 // BID: 85867 // VULHUB: VHN-91937 // PACKETSTORM: 136592

AFFECTED PRODUCTS

vendor:broadcommodel:api gatewayscope:eqversion:8.3

Trust: 1.0

vendor:broadcommodel:api gatewayscope:eqversion:8.2

Trust: 1.0

vendor:broadcommodel:api gatewayscope:eqversion:7.1

Trust: 1.0

vendor:broadcommodel:api gatewayscope:eqversion:8.0

Trust: 1.0

vendor:broadcommodel:api gatewayscope:eqversion:8.4

Trust: 1.0

vendor:broadcommodel:api gatewayscope:eqversion:8.1

Trust: 1.0

vendor:camodel:api gatewayscope:eqversion:8.0 from 8.3.01

Trust: 0.8

vendor:camodel:api gatewayscope:ltversion:8.3

Trust: 0.8

vendor:camodel:api gatewayscope:ltversion:8.4

Trust: 0.8

vendor:camodel:api gatewayscope:eqversion:8.4.01

Trust: 0.8

vendor:camodel:api gatewayscope:ltversion:7.1

Trust: 0.8

vendor:camodel:api gatewayscope:eqversion:7.1.04

Trust: 0.8

vendor:camodel:api gatewayscope:eqversion:8.2

Trust: 0.6

vendor:camodel:api gatewayscope:eqversion:7.1

Trust: 0.6

vendor:camodel:api gatewayscope:eqversion:8.3

Trust: 0.6

vendor:camodel:api gatewayscope:eqversion:8.1

Trust: 0.6

vendor:camodel:api gatewayscope:eqversion:8.0

Trust: 0.6

vendor:camodel:api gatewayscope:eqversion:8.4

Trust: 0.6

sources: JVNDB: JVNDB-2016-001938 // CNNVD: CNNVD-201604-034 // NVD: CVE-2016-3118

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-3118
value: MEDIUM

Trust: 1.0

NVD: CVE-2016-3118
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201604-034
value: MEDIUM

Trust: 0.6

VULHUB: VHN-91937
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-3118
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-91937
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-3118
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.5
version: 3.0

Trust: 1.0

NVD: CVE-2016-3118
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
attackVector: PHYSICAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-91937 // JVNDB: JVNDB-2016-001938 // CNNVD: CNNVD-201604-034 // NVD: CVE-2016-3118

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-Other

Trust: 0.8

sources: JVNDB: JVNDB-2016-001938 // NVD: CVE-2016-3118

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 136592 // CNNVD: CNNVD-201604-034

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201604-034

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-001938

PATCH
title:CA20160405-01: Security Notice for CA API Gatewayurl:http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160405-01-security-notice-for-ca-api-gateway.aspx
Trust: 0.8
title:CA API Gateway CRLF Repair measures for injecting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60769
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-001938 // 
            
            
            
            CNNVD: CNNVD-201604-034

EXTERNAL IDS
db:NVDid:CVE-2016-3118
Trust: 2.9
db:JVNDBid:JVNDB-2016-001938
Trust: 0.8
db:CNNVDid:CNNVD-201604-034
Trust: 0.7
db:BIDid:85867
Trust: 0.4
db:PACKETSTORMid:136592
Trust: 0.2
db:VULHUBid:VHN-91937
Trust: 0.1
sources:
            
            
            VULHUB: VHN-91937 // 
            
            
            
            BID: 85867 // 
            
            
            
            JVNDB: JVNDB-2016-001938 // 
            
            
            
            PACKETSTORM: 136592 // 
            
            
            
            CNNVD: CNNVD-201604-034 // 
            
            
            
            NVD: CVE-2016-3118

REFERENCES
url:http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160405-01-security-notice-for-ca-api-gateway.aspx
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3118
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3118
Trust: 0.8
url:https://support.ca.com/
Trust: 0.1
url:https://support.ca.com/irj/portal/anonymous/phpsbpldgpg
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-3118
Trust: 0.1
url:https://www.ca.com/us/support/ca-support-online/documents.aspx?id=177782
Trust: 0.1
sources:
            
            
            VULHUB: VHN-91937 // 
            
            
            
            JVNDB: JVNDB-2016-001938 // 
            
            
            
            PACKETSTORM: 136592 // 
            
            
            
            CNNVD: CNNVD-201604-034 // 
            
            
            
            NVD: CVE-2016-3118

CREDITS
Patrick Webster of OSI Security
Trust: 0.3
sources:
            
            
            BID: 85867

SOURCES
db:VULHUBid:VHN-91937
db:BIDid:85867
db:JVNDBid:JVNDB-2016-001938
db:PACKETSTORMid:136592
db:CNNVDid:CNNVD-201604-034
db:NVDid:CVE-2016-3118

LAST UPDATE DATE
2025-04-13T23:27:26.045000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-91937date:2016-04-07T00:00:00
db:BIDid:85867date:2016-04-05T00:00:00
db:JVNDBid:JVNDB-2016-001938date:2016-04-08T00:00:00
db:CNNVDid:CNNVD-201604-034date:2021-04-08T00:00:00
db:NVDid:CVE-2016-3118date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-91937date:2016-04-06T00:00:00
db:BIDid:85867date:2016-04-05T00:00:00
db:JVNDBid:JVNDB-2016-001938date:2016-04-08T00:00:00
db:PACKETSTORMid:136592date:2016-04-06T13:39:41
db:CNNVDid:CNNVD-201604-034date:2016-04-06T00:00:00
db:NVDid:CVE-2016-3118date:2016-04-06T01:59:28.840