Novell File Reporter is software that allows network administrators to identify files stored on the network and generates reports regarding the size of individual files, file type, when files were last accessed, and where duplicates exist. The Novell File Reporter communicates over HTTPS on port 3037/TCP.
Novell File Reporter contains an arbitrary file upload vulnerability which could allow a remote unauthenticated user to upload and execute arbitrary files with SYSTEM privileges. The specific vulnerability is in the
read_file_sub_40A190() function of
NFRAgent.exe when handling requests on the URL
/FSF/CMD for records with NAME
FSFUI, UICMD 130, and tag
Apply an update when it becomes available. Allow only trusted networks and hosts to communicate with the Novell File Reporter agent.
This exploit was tested against Novell File Reporter 220.127.116.11 on Microsoft Windows Server 2003 SP2 English (DEP OptOut).
The IO-Socket-SSL and Digest:MD5 PERL modules must be installed on the scanning host. The IO-Socket-SSL module is available from <http://www.cpan.org/modules/by-module/IO/>. The Digest::MD5 module is available from <http://cpan.org/modules/by-module/MD5/>.