Novell ZENworks Configuration Management ZAM File Remote Code Execution Vulnerability
BID:47295
Info
Novell ZENworks Configuration Management ZAM File Remote Code Execution Vulnerability
| Bugtraq ID: | 47295 |
| Class: | Unknown |
| CVE: |
CVE-2010-4229 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 08 2011 12:00AM |
| Updated: | May 30 2011 04:41PM |
| Credit: | AbdulAziz Hariri of ThirdEyeTesters |
| Vulnerable: |
Novell ZENworks Configuration Management 10.1.2 a Novell ZENworks Configuration Management 10.1.2 Novell ZENworks Configuration Management 10.3.1 Novell ZENworks Configuration Management 10.3 Novell ZENworks Configuration Management 10.1 |
| Not Vulnerable: |
Novell ZENworks Configuration Management 10.3.2 |
Discussion
Novell ZENworks Configuration Management ZAM File Remote Code Execution Vulnerability
Novell ZENworks Configuration Management is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code in the context of the 'ZenWorks' user. Successful attacks will completely compromise the affected computer. Failed attacks will likely cause denial-of-service conditions.
ZENworks Configuration Management versions prior to 10.3.2 are vulnerable.
Novell ZENworks Configuration Management is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code in the context of the 'ZenWorks' user. Successful attacks will completely compromise the affected computer. Failed attacks will likely cause denial-of-service conditions.
ZENworks Configuration Management versions prior to 10.3.2 are vulnerable.
Exploit / POC
Novell ZENworks Configuration Management ZAM File Remote Code Execution Vulnerability
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
Novell ZENworks Configuration Management ZAM File Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Novell ZENworks Configuration Management ZAM File Remote Code Execution Vulnerability
References:
References:
- ZENworks Product Page (Novell)
- ZDI-11-118: Novell ZENworks Asset Management Path Traversal File Overwrite Remot (Zero Day Initiative)
- ZAM File Overwrite Remote Code Execution Vulnerability (Novell)