The non-Domino web agents in CA Single Sign-On (aka SSO formerly SiteMinder) R6 R12.0 before SP3 CR13 R12.0J before SP3 CR1.2 and R12.5 before CR5 allow remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.