Novell ZENworks Configuration Management CVE-2010-5323 Directory Traversal Vulnerability

Bugtraq ID:	75051
Class:	Input Validation Error
CVE:	CVE-2010-5323
Remote:	Yes
Local:	No
Published:	Apr 23 2010 12:00AM
Updated:	Apr 23 2010 12:00AM
Credit:	Stephen Fewer of Harmony Security
Vulnerable:	Novell ZENworks Configuration Management 10.1.2 a Novell ZENworks Configuration Management 10.1.2 Novell ZENworks Configuration Management 10.2 Novell ZENworks Configuration Management 10.1 Novell ZENworks Configuration Management 10.0
Not Vulnerable:	Novell ZENworks Configuration Management 10.3

Novell ZENworks Configuration Management CVE-2010-5323 Directory Traversal Vulnerability

Novell ZENworks Configuration Management is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary code in the context of an affected application or to obtain sensitive information that could aid in further attacks.

Versions prior to Novell ZENworks Configuration Management 10.3 are vulnerable.

Novell ZENworks Configuration Management CVE-2010-5323 Directory Traversal Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Novell ZENworks Configuration Management CVE-2010-5323 Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Novell ZENworks Configuration Management CVE-2010-5323 Directory Traversal Vulnerability

References:

• Novell Homepage (Novell)
  
• ZDI-10-078: Novell ZENworks Configuration Management UploadServlet Remote Code E (Zero Day Initiative)
  
• Security Vulnerability with ZCM (Novell)