PT-2006-4316 · Novell+1 · Fastpatch For Novell Zenworks+3

Chris Steipp · Publicado 2006-07-07 · Atualizado 2018-10-18 · CVE-2006-3425

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FastPatch for PatchLink Update Server (PLUS) versions prior to 6.1 P1 and 6.2.x prior to 6.2 SR1 P1 FastPatch for Novell ZENworks versions prior to 6.2 SR1

Description The issue allows remote attackers to list, add, or delete PatchLink Distribution Point (PDP) proxy servers without requiring authentication. This can be achieved by modifying certain parameters in the dagent/proxyreg.asp endpoint, specifically the List, Proxy, or Delete parameters.

Recommendations For FastPatch for PatchLink Update Server (PLUS) versions prior to 6.1 P1 and 6.2.x prior to 6.2 SR1 P1, update to version 6.1 P1 or 6.2 SR1 P1 or later. For FastPatch for Novell ZENworks versions prior to 6.2 SR1, update to version 6.2 SR1 or later. As a temporary workaround, consider restricting access to the dagent/proxyreg.asp endpoint to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-3425

Produtos afetados

Fastpatch For Novell Zenworks

Fastpatch For Patchlink Update Server

Novell Zenworks

Patchlink Distribution Point

Referências · 10

• http://vupen.com/english/advisories/2006/2596 · Nota
• http://securityfocus.com/bid/18723 · Nota
• http://vupen.com/english/advisories/2006/2595 · Nota
• http://securityreason.com/securityalert/1200 · Nota
• http://secunia.com/advisories/20878 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-3425 · Nota de Segurança
• http://securityfocus.com/archive/1/438710/100/0/threaded · Nota
• http://secunia.com/advisories/20876 · Aviso do Fabricante
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html · Nota
• http://securitytracker.com/id?1016405 · Correção