PT-2012-6202 · Netiq · Netiq Privileged User Manager

Publicado 2012-12-24 · Atualizado 2021-04-13 · CVE-2012-5930

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions NetIQ Privileged User Manager versions 2.3.x through 2.3.1 before HF2

Description The issue concerns the pa modify accounts function in auth.dll within unifid.exe, which does not require authentication for the modifyAccounts method. This allows remote attackers to change administrative account passwords by sending a crafted application/x-amf request.

Recommendations For versions 2.3.x through 2.3.1 before HF2, update to version 2.3.1 HF2 to resolve the issue. As a temporary workaround, consider restricting access to the modifyAccounts method until the update is applied.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2012-5930

Produtos afetados

Netiq Privileged User Manager

Referências · 6

• 🔥 http://retrogod.altervista.org/9sg_novell_netiq_i.htm · Exploit
• 🔥 https://exploit-db.com/exploits/22737 · Exploit
• 🔥 http://retrogod.altervista.org/9sg_novell_netiq_i_adv.htm · Exploit
• https://netiq.com/support/kb/doc.php?id=7011385 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-5930 · Nota de Segurança
• http://download.novell.com/Download?buildid=K6-PmbPjduA~ · Nota