PT-2012-6204 · Netiq · Netiq Privileged User Manager

Publicado 2012-12-24 · Atualizado 2021-04-13 · CVE-2012-5932

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NetIQ Privileged User Manager versions 2.3.x through 2.3.1 before HF2

Description The issue allows remote attackers to execute arbitrary Perl code via a crafted application/x-amf request. This is due to an eval injection vulnerability in the ldapagnt eval function in ldapagnt.dll in unifid.exe.

Recommendations For versions 2.3.x through 2.3.1 before HF2, update to version 2.3.1 HF2 to resolve the issue. As a temporary workaround, consider restricting access to the ldapagnt eval function in ldapagnt.dll to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2012-5932

Produtos afetados

Netiq Privileged User Manager

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/novell/netiq_pum_eval.rb · Exploit
• 🔥 http://retrogod.altervista.org/9sg_novell_netiq_ii.htm · Exploit
• 🔥 https://exploit-db.com/exploits/22903 · Exploit
• 🔥 http://retrogod.altervista.org/9sg_novell_netiq_ldapagnt_adv.htm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5932 · Nota de Segurança
• https://t.me/cvenotify/13168 · Publicação no Telegram
• http://download.novell.com/Download?buildid=K6-PmbPjduA~ · Nota
• https://netiq.com/support/kb/doc.php?id=7011385 · Aviso do Fabricante