Symptom:
Malicious smerrorpage parameter can be injected because the error page was not validated.
Solution:
This issue is fixed. Use the following agent parameter to validate the domains of error pages:
Specifies a list of valid domains for customized SiteMinder error pages. SiteMinder only redirects users to custom error pages when the domain of the error page appears in this parameter. If the domain is not listed, then a blank error page is displayed and a corresponding unauthorized message (such as smpwservices.unauth) is returned.
Default: None (no domains listed).
STAR Issue #: 20628512:01
|
Copyright © 2012 CA.
All rights reserved.
|
|