CVE-2006-3425

2006-07-0700:00:00

mitre

www.cve.org

AI Score

Confidence

Low

EPSS

0.03

Percentile

90.9%

JSON

FastPatch for (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1, and (b) Novell ZENworks 6.2 SR1 and earlier, does not require authentication for dagent/proxyreg.asp, which allows remote attackers to list, add, or delete PatchLink Distribution Point (PDP) proxy servers via modified (1) List, (2) Proxy, or (3) Delete parameters.

References

lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html

secunia.com/advisories/20876

secunia.com/advisories/20878

securityreason.com/securityalert/1200

securitytracker.com/id?1016405

www.securityfocus.com/archive/1/438710/100/0/threaded

www.securityfocus.com/bid/18723

www.vupen.com/english/advisories/2006/2595

www.vupen.com/english/advisories/2006/2596