Novell ZENworks Configuration Management Preboot Service Remote Code Execution Vulnerability

Bugtraq ID:	39111
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Mar 30 2010 12:00AM
Updated:	Mar 30 2010 12:00AM
Credit:	Stephen Fewer of Harmony Security via TippingPoint's Zero Day Initiative
Vulnerable:	Novell ZENworks Configuration Management 10.1.2 a Novell ZENworks Configuration Management 10.1.2 Novell ZENworks Configuration Management 10.1
Not Vulnerable:	Novell ZENworks Configuration Management 10.3

Novell ZENworks Configuration Management Preboot Service Remote Code Execution Vulnerability

Novell ZENworks Configuration Management is prone to an unspecified remote code-execution vulnerability.

An attacker can leverage this issue to execute arbitrary code with SYSTEM-level privileges. Failed exploit attempts will result in a denial-of-service condition.

Versions prior to ZENworks Configuration Management 10.3 are vulnerable.

Novell ZENworks Configuration Management Preboot Service Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Novell ZENworks Configuration Management Preboot Service Remote Code Execution Vulnerability

Solution:
Updates are available; please see the references for more information.

Novell ZENworks Configuration Management Preboot Service Remote Code Execution Vulnerability

References:

• Security Vulnerability with ZCM Preboot Service (Novell)
  
• ZENworks Configuration Management Homepage (Novell)