Novell ZENworks Configuration Management CVE-2013-1084 Directory Traversal Vulnerability

Bugtraq ID:	63433
Class:	Input Validation Error
CVE:	CVE-2013-1084
Remote:	Yes
Local:	No
Published:	Oct 29 2013 12:00AM
Updated:	Nov 27 2013 12:24AM
Credit:	Brett Gervasoni
Vulnerable:
Not Vulnerable:

Novell ZENworks Configuration Management CVE-2013-1084 Directory Traversal Vulnerability

Novell ZENworks Configuration Management is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Novell ZENworks Configuration Management 11.2.3 is vulnerable.

Novell ZENworks Configuration Management CVE-2013-1084 Directory Traversal Vulnerability

Attackers can exploit this issue with a web browser or readily available tools.

The following example URI is available:

http://www.example.com/zenworks-unmaninv/?action=GetFile&Filename=../../catalog.ini&Type=4&Platform=11&Lang=0

Novell ZENworks Configuration Management CVE-2013-1084 Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Novell ZENworks Configuration Management CVE-2013-1084 Directory Traversal Vulnerability

References:

• Novell Homepage (Novell)
  
• ZENworks Configuration Management Homepage (Novell)