ZAM File Overwrite Remote Code Execution Vulnerability

  • Document ID:7007841
  • Creation Date:08-Feb-2011
  • Modified Date:27-Apr-2012
    • Micro Focus Products:
      ZENworks Configuration Management

Environment

Novell ZENworks 10 Configuration Management with Support Pack 3 - 10.3 Inventory
Novell ZENworks 11 Configuration Management Inventory

Situation

An issue exists where specific traversal file modifications can cause remote code execution by an inventory service. 

Resolution

For ZCM 10.x: This is fixed in version 10.3.2 - see KB 7007237 "ZENworks Configuration Management 10.3.2 - update information and list of fixes" which can be found at https://www.novell.com/support

For ZCM 11.x: This is fixed in version 11.1 - see KB 7008746 "ZENworks Configuration Management 11.1 - update information and list of fixes" which can be found at https://www.novell.com/support

Status

Security Alert

Additional Information

This was reported as ZDI-CAN-986 byTippingPoint Corporation.  This vulnerability was discovered by: AbdulAziz Hariri of ThirdEyeTesters.  This is CVE-2010-4229