Novell ZENworks Configuration Management Multiple Security Vulnerabilities

Bugtraq ID:	52659
Class:	Input Validation Error
CVE:	CVE-2011-3175 CVE-2011-3176 CVE-2012-2215
Remote:	Yes
Local:	No
Published:	Mar 21 2012 12:00AM
Updated:	Mar 13 2013 05:25PM
Credit:	Luigi Auriemma
Vulnerable:	Novell ZENworks Configuration Management 11.1A Novell ZENworks Configuration Management 11.1
Not Vulnerable:	Novell ZENworks Configuration Management 11.2

Novell ZENworks Configuration Management Multiple Security Vulnerabilities

Novell ZENworks Configuration Management is prone to following vulnerabilities:

1. A stack-based buffer-overflow vulnerability
2. An arbitrary file download vulnerability

Exploiting these issues may allow remote attackers to execute arbitrary code or retrieve arbitrary files within the context of the affected application.

Novell ZENworks Configuration Management Multiple Security Vulnerabilities

The following exploit codes are available:

• /data/vulnerabilities/exploits/52659-1.rb.txt
• /data/vulnerabilities/exploits/52659-2.rb.txt

Novell ZENworks Configuration Management Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references for details.

Novell ZENworks Configuration Management Multiple Security Vulnerabilities

References:

• ZENworks Configuration Management Homepage (Novell)
  
• ZCM 11.1/11.1a fix for PreBoot Service Vulnerabilities - see TID 7009969, TID 70 (Novell)
  
• ZENworks Configuration Management 11.2 - update information and list of fixes (Novell)