Novell ZENworks Configuration Management CVE-2015-0779 Remote File Upload Vulnerability

Bugtraq ID:	73949
Class:	Input Validation Error
CVE:	CVE-2015-0779
Remote:	Yes
Local:	No
Published:	Apr 07 2015 12:00AM
Updated:	May 12 2015 07:53PM
Credit:	Pedro Ribeiro
Vulnerable:	Novell ZENworks Configuration Management 10.3.4 Novell ZENworks Configuration Management 10.3.3 Novell ZENworks Configuration Management 10.1.2 Novell ZENworks Configuration Management 11.2 Novell ZENworks Configuration Management 11.1 Novell ZENworks Configuration Management 10.3.2 Novell ZENworks Configuration Management 10.3.1 Novell ZENworks Configuration Management 10.3 Novell ZENworks Configuration Management 10.2 Novell ZENworks Configuration Management 10.1
Not Vulnerable:

Novell ZENworks Configuration Management CVE-2015-0779 Remote File Upload Vulnerability

Novell ZENworks Configuration Management is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

Novell ZENworks Configuration Management 11.3.1 and prior are vulnerable.

Novell ZENworks Configuration Management CVE-2015-0779 Remote File Upload Vulnerability

Attackers can exploit this issue using a browser.

The following exploit is available:

• /data/vulnerabilities/exploits/73949.rb

Novell ZENworks Configuration Management CVE-2015-0779 Remote File Upload Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Novell ZENworks Configuration Management CVE-2015-0779 Remote File Upload Vulnerability

References:

• ZENworks Configuration Management Homepage (Novell)