Novell Identity Manager Fan-Out Linux and UNIX Receiver Script Code Injection Vulnerability

Bugtraq ID:	20016
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 14 2006 12:00AM
Updated:	Sep 14 2006 09:32PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Novell Identity Manager 3.0.1
Not Vulnerable:

Novell Identity Manager Fan-Out Linux and UNIX Receiver Script Code Injection Vulnerability

Novell Identity Manager is prone to a code-injection vulnerability.

A local attacker with administrative rights to the Identity Manager can exploit this issue to completely compromise an affected computer.

The vulnerability affects version 3.0.1; previous versions may be affected as well.

Novell Identity Manager Fan-Out Linux and UNIX Receiver Script Code Injection Vulnerability

To exploit this issue, an attacker can use the vulnerable application itself.

Novell Identity Manager Fan-Out Linux and UNIX Receiver Script Code Injection Vulnerability

Solution:
The vendor has released a patch to address this issue.

Please see the references for more information.


Novell Identity Manager 3.0.1

• Novell idm301fansec1.tgz
  http://support.novell.com/servlet/filedownload/sec/ftf/idm301fansec1.t gz

Novell Identity Manager Fan-Out Linux and UNIX Receiver Script Code Injection Vulnerability

References:

• IDM 3.0.1 Fan-out Security Patch 1 - TID2974421 (last modified 12SEP2006) (Novell)
  
• Novell Homepage (Novell)