Novell iManager 'getMultiPartParameters()' Arbitrary File Upload Vulnerability

Bugtraq ID:	43635
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 01 2010 12:00AM
Updated:	Oct 19 2010 07:29AM
Credit:	Stephen Fewer of Harmony Security working with TippingPoint's Zero Day Initiative
Vulnerable:	Novell iManager 2.7.3 Novell iManager 2.7.1 Novell iManager 2.5 Novell iManager 2.0.2 Novell iManager 2.0 Novell iManager 2.7.3.2 Novell iManager 2.7.3 FTF2 Novell iManager 2.7.0 Novell iManager 2.6.0
Not Vulnerable:	Novell iManager 2.7.3 FTF3

Novell iManager 'getMultiPartParameters()' Arbitrary File Upload Vulnerability

Novell iManager is prone to an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

Novell iManager 2.7.3.2 and prior are vulnerable.

Novell iManager 'getMultiPartParameters()' Arbitrary File Upload Vulnerability

Attackers can exploit this issue using readily available tools.

A Metasploit exploit module is available:

• /data/vulnerabilities/exploits/43635.rb

Novell iManager 'getMultiPartParameters()' Arbitrary File Upload Vulnerability

Solution:
Updates are available. Please see the references for details.

Novell iManager 'getMultiPartParameters()' Arbitrary File Upload Vulnerability

References:

• iManager Homepage (Novell)
  
• Security Vulnerability - iManager getMultiPartParameters Arbitrary File Upload (Novell)
  
• ZDI-10-190: Novell iManager getMultiPartParameters Arbitrary File Upload Remote (ZDI Disclosures )
  
• ZDI-10-190 Novell iManager getMultiPartParameters Arbitrary File Upload Remote C (Zero Day Initiative)