Novell ZENworks Configuration Management CVE-2013-6347 Session Fixation Vulnerability

Bugtraq ID:	63495
Class:	Input Validation Error
CVE:	CVE-2013-6347
Remote:	Yes
Local:	No
Published:	Mar 26 2013 12:00AM
Updated:	Mar 26 2013 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Novell ZENworks Configuration Management 11.2.3 Novell ZENworks Configuration Management 11.2 Novell ZENworks Configuration Management 11.1 Novell ZENworks Configuration Management 11.0
Not Vulnerable:	Novell ZENworks Configuration Management 11.2.4

Novell ZENworks Configuration Management CVE-2013-6347 Session Fixation Vulnerability

Novell ZENworks Configuration Management is prone to a session-fixation vulnerability.

An attacker can exploit this issue to hijack an arbitrary session and gain unauthorized access to the affected application.

Versions prior to Novell ZENworks Configuration Management 11.2.4 are vulnerable.

Novell ZENworks Configuration Management CVE-2013-6347 Session Fixation Vulnerability

To exploit this issue an attacker entices an unsuspecting user into following a malicious URI.

Novell ZENworks Configuration Management CVE-2013-6347 Session Fixation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Novell ZENworks Configuration Management CVE-2013-6347 Session Fixation Vulnerability

References:

• ZENworks Configuration Management 11.2.4 - update information and list of fixes (Novell)
  
• ZENworks Configuration Management Homepage (Novell)