Novell ZENworks Control Center file upload vulnerability

Added: 05/03/2013
CVE: CVE-2013-1080
BID: 58668
OSVDB: 91627

Background

Novell ZENworks Configuration Management is an IT desktop computer management suite that provides the ability to install, configure and administer desktop computers from a centralized location. The product is based on a client/server architecture.

Problem

The ZENworks Configuration Management Control Center does not sufficiently enforce authentication for file uploads, and is also affected by a directory traversal vulnerability. A remote attacker could execute arbitrary commands by exploiting these two vulnerabilities together.

Resolution

Apply the appropriate patch referenced in Novell Knowledge Base document 7011812.

References

<http://www.zerodayinitiative.com/advisories/ZDI-13-049/&gt;

Limitations

Exploit works on Novell ZENworks Configuration Management 11 SP2 on Windows Server 2003 SP2 English (DEP OptOut) and Microsoft Windows Server 2008 SP2 (DEP OptOut). Exploit also works on Novell ZENworks Configuration Management Appliance 11 SP2 on SUSE Linux Enterprise Server 11 (x86_64) SP1.

Exploit requires the IO::Socket::SSL Perl module to be installed on the SAINTexploit host.

Platforms

Windows
Linux