Computer Associates Unicenter TNG PDMCGI.EXE Template File Disclosure Vulnerability

Bugtraq ID:	7811
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 04 2003 12:00AM
Updated:	Jun 04 2003 12:00AM
Credit:	Discovery is credited to Joao Gouveia <[email protected]>.
Vulnerable:	Computer Associates Unicenter TNG 2.4.2 Computer Associates Unicenter TNG 2.4 Computer Associates Unicenter TNG 2.1
Not Vulnerable:

Computer Associates Unicenter TNG PDMCGI.EXE Template File Disclosure Vulnerability

Computer Associates Unicenter TNG is reported to be prone to a file disclosure vulnerability. Helpdesk or other unauthorized users may gain access to files by specifying an arbitrary file as a template to the 'pdmcgi.exe' utility.

Computer Associates Unicenter TNG PDMCGI.EXE Template File Disclosure Vulnerability

This issue may be exploited with a web browser.

Computer Associates Unicenter TNG PDMCGI.EXE Template File Disclosure Vulnerability

Solution:
This issue has allegedly been addressed by the vendor. Users should contact the vendor to determine if fixes are available.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Computer Associates Unicenter TNG PDMCGI.EXE Template File Disclosure Vulnerability

References:

• Re: CA Unicenter Password Recovery Tool (Joao Gouveia )