Novell File Reporter 'NFRAgent.exe' Multiple Security Vulnerabilities

Bugtraq ID:	56579
Class:	Unknown
CVE:	CVE-2012-4956 CVE-2012-4957 CVE-2012-4958 CVE-2012-4959
Remote:	Yes
Local:	No
Published:	Nov 16 2012 12:00AM
Updated:	Dec 12 2012 07:30PM
Credit:	Juan Vazquez
Vulnerable:	Novell File Reporter Agent 1.0.2
Not Vulnerable:

Novell File Reporter 'NFRAgent.exe' Multiple Security Vulnerabilities

Novell File Reporter is prone to the following security vulnerabilities:

1. A heap-based buffer-overflow vulnerability

2. Multiple arbitrary file-download vulnerabilities

3. An arbitrary file-upload vulnerability

Remote attackers can exploit these issues to upload and download arbitrary files and execute arbitrary code in the context of the application.

Novell File Reporter 1.0.2 is vulnerable; other versions may also be affected.

Novell File Reporter 'NFRAgent.exe' Multiple Security Vulnerabilities

The following exploit codes are available; please see the references for more information.

• /data/vulnerabilities/exploits/56579.rb
• /data/vulnerabilities/exploits/56579.py

Novell File Reporter 'NFRAgent.exe' Multiple Security Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Novell File Reporter 'NFRAgent.exe' Multiple Security Vulnerabilities

References:

• Novell File Reporter (Novell)