ZENworks Mobile Management DUSAP.php Vulnerability

  • 7011896
  • 13-Mar-2013
  • 31-May-2013


Novell ZENworks Mobile Management 2.7.0
Novell ZENworks Mobile Management 2.6.1


A vulnerability has been identified with the ZMM.This product installs a php based web interface on IIS. By invoking directly a script called DUSAP.php, it is possible to bypass the authentication mechanism.


This fix will be incorporated into future releases


This is effectively the result of missing validation checks of the language variable.


Security Alert

Additional Information

The fix is a simple check of the value of the language variable against the supported languages. It receives a 'language' variable which later is used to include arbitrary resources from the local filesystem via require_once()

This vulnerability was discovered by: Andrea Micalizzi (aka rgod)
Reported to Novell by ZDI / Tippingpoint

Assinged Identifiers

Feedback service temporarily unavailable. For content questions or problems, please contact Support.