Environment
Novell ZENworks Configuration Management 11.2
Novell ZENworks Configuration Management 10.3
Novell ZENworks Configuration Management 10.3
Situation
A vulnerability has been identified with ZCM. There was
insufficient authentication checking on file uploads through the
ZCM webserver. This could allow files to be placed on the
filesystem of the underlying OS.
Resolution
This is fixed in version 11.3 - see KB 7014213 "ZENworks
Configuration Management 11.3 - update information and list of
fixes" which can be found at
https://support.microfocus.com/kb/doc.php?id=7014213
For ZCM 11.2.3: This is fixed in version 11.2.4 - see KB 7012027 "ZENworks Configuration Management 11.2.4 - update information and list of fixes" which can be found at https://support.microfocus.com/kb/doc.php?id=7012027
Workaround: if it is not possible to upgrade to ZCM 11.2.4 at this time, in the interim, Novell has made a Patch available for testing, as part of a Monthly patch update: it can be obtained at https://download.novell.com/Download?buildid=s5zcEae9xcI~ as "ZCM 11.2.3a Monthly Update 1 - see TID 7012025". This update should only be applied if the symptoms above are being experienced, and are causing problems.
For ZCM 11.2.2 Monthly Update 2: A fix for this issue is intended to be included in a future update to the product: however, in the interim, Novell has made a Patch available for testing, in the form of a Field Test File (FTF): it can be obtained at https://download.novell.com/Download?buildid=FqytscocWtM~ as "ZCM 11.2.2 MU1/MU2 fix for Server out of Sync errors - see KB 7011404 and ZCC File Upload Remote Code Execution Vulnerability - see TID 7011812". This Patch should only be applied if the symptoms above are being experienced, and are causing problems.
This Patch has had limited testing, and should not be used in a production system without first being checked in a test environment. Some Patches have specific requirements for deployment, it is very important to follow any instructions in the readme at the download site. Please report any problems encountered when using this Patch, by using the feedback link on this TID.
For ZCM 11.2.3: This is fixed in version 11.2.4 - see KB 7012027 "ZENworks Configuration Management 11.2.4 - update information and list of fixes" which can be found at https://support.microfocus.com/kb/doc.php?id=7012027
Workaround: if it is not possible to upgrade to ZCM 11.2.4 at this time, in the interim, Novell has made a Patch available for testing, as part of a Monthly patch update: it can be obtained at https://download.novell.com/Download?buildid=s5zcEae9xcI~ as "ZCM 11.2.3a Monthly Update 1 - see TID 7012025". This update should only be applied if the symptoms above are being experienced, and are causing problems.
For ZCM 11.2.2 Monthly Update 2: A fix for this issue is intended to be included in a future update to the product: however, in the interim, Novell has made a Patch available for testing, in the form of a Field Test File (FTF): it can be obtained at https://download.novell.com/Download?buildid=FqytscocWtM~ as "ZCM 11.2.2 MU1/MU2 fix for Server out of Sync errors - see KB 7011404 and ZCC File Upload Remote Code Execution Vulnerability - see TID 7011812". This Patch should only be applied if the symptoms above are being experienced, and are causing problems.
This Patch has had limited testing, and should not be used in a production system without first being checked in a test environment. Some Patches have specific requirements for deployment, it is very important to follow any instructions in the readme at the download site. Please report any problems encountered when using this Patch, by using the feedback link on this TID.
Status
Security AlertAdditional Information
This vulnerability has been assigned the identifier CVE-2013-1080
by the CVE database
This vulnerability was discovered by:James Burton@Insomnia Security and Provided by Tipping Point ZDI-CAN-1527:
This vulnerability was discovered by:James Burton@Insomnia Security and Provided by Tipping Point ZDI-CAN-1527: