LANDesk Management Gateway 'DRIVES' Parameter Remote Command Execution Vulnerability

Bugtraq ID:	44781
Class:	Input Validation Error
CVE:	CVE-2010-2892
Remote:	Yes
Local:	No
Published:	Nov 10 2010 12:00AM
Updated:	Nov 12 2010 05:27PM
Credit:	Aureliano Calvo
Vulnerable:	LANDesk Software Landesk Management Gateway 4.2-1.8 LANDesk Software Landesk Management Gateway 4.2-1.61 LANDesk Software Landesk Management Gateway 4.0-1.61s LANDesk Software Landesk Management Gateway 4.0-1.48
Not Vulnerable:	LANDesk Software Landesk Management Gateway 4.2-1.62 LANDesk Software Landesk Management Gateway 4.0-1.62

LANDesk Management Gateway 'DRIVES' Parameter Remote Command Execution Vulnerability

LANDesk Management Gateway is prone to a remote command-execution vulnerability because the appliance fails to adequately sanitize user-supplied input.

Successful exploitation may allow an attacker to execute arbitrary commands and completely compromise the device.


LANDesk Management Gateway 4.0-1.48, 4.2-1.8, 4.0-1.61s and 4.2-1.61 versions are affected.

LANDesk Management Gateway 'DRIVES' Parameter Remote Command Execution Vulnerability

An attacker can exploit this issue using a browser.

The following exploit is available:

• /data/vulnerabilities/exploits/44781.html

LANDesk Management Gateway 'DRIVES' Parameter Remote Command Execution Vulnerability

Solution:
The vendor has released updates to address this issue. Please see the references for more information.

LANDesk Management Gateway 'DRIVES' Parameter Remote Command Execution Vulnerability

References:

• LANDesk Management Gateway Homepage (LANDesk Software)
  
• Landesk OS command injection (Core Security Technologies)
  
• Vulnerability in the LANDesk Management Gateway (LANDesk Software)