Novell ZENworks Handheld Management 'ZfHSrvr.exe' Service Directory Traversal Vulnerability

Bugtraq ID:	48467
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 27 2011 12:00AM
Updated:	Aug 02 2011 04:10PM
Credit:	Luigi Auriemma
Vulnerable:	Novell ZENworks Handheld Management 7.0.2.61213 Novell ZENworks Handheld Management 7
Not Vulnerable:

Novell ZENworks Handheld Management 'ZfHSrvr.exe' Service Directory Traversal Vulnerability

Novell ZENworks Handheld Management is prone to a directory-traversal vulnerability in the 'ZfHSrvr.exe' service because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to upload arbitrary files to the affected system.

ZENworks Handheld Management 7.0.2.61213 and prior are vulnerable; other versions may also be affected.

Novell ZENworks Handheld Management 'ZfHSrvr.exe' Service Directory Traversal Vulnerability

Attackers can use readily available tools to exploit this issue.

The following command and exploit file are available:

nc SERVER 2398 < 48467.dat

Novell ZENworks Handheld Management 'ZfHSrvr.exe' Service Directory Traversal Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Novell ZENworks Handheld Management 'ZfHSrvr.exe' Service Directory Traversal Vulnerability

References:

• Novell ZENworks Handheld Management Homepage (Novell)
  
• Upload Directory Traversal (Luigi Auriemma)
  
• Upload directory traversal in Novell ZenWorks Handheld Management (Luigi Auriemma)