PT-2006-4316 · Novell+1 · Fastpatch For Novell Zenworks+3

Chris Steipp · Published 2006-07-07 · Updated 2018-10-18 · CVE-2006-3425

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FastPatch for PatchLink Update Server (PLUS) versions prior to 6.1 P1 and 6.2.x prior to 6.2 SR1 P1 FastPatch for Novell ZENworks versions prior to 6.2 SR1

Description The issue allows remote attackers to list, add, or delete PatchLink Distribution Point (PDP) proxy servers without requiring authentication. This can be achieved by modifying certain parameters in the dagent/proxyreg.asp endpoint, specifically the List, Proxy, or Delete parameters.

Recommendations For FastPatch for PatchLink Update Server (PLUS) versions prior to 6.1 P1 and 6.2.x prior to 6.2 SR1 P1, update to version 6.1 P1 or 6.2 SR1 P1 or later. For FastPatch for Novell ZENworks versions prior to 6.2 SR1, update to version 6.2 SR1 or later. As a temporary workaround, consider restricting access to the dagent/proxyreg.asp endpoint to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-3425

Affected Products

Fastpatch For Novell Zenworks

Fastpatch For Patchlink Update Server

Novell Zenworks

Patchlink Distribution Point

References · 10

• http://secunia.com/advisories/20878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3425 · Security Note
• http://secunia.com/advisories/20876 · Vendor Advisory
• http://securitytracker.com/id?1016405 · Patch
• http://vupen.com/english/advisories/2006/2596 · Note
• http://securityfocus.com/bid/18723 · Note
• http://vupen.com/english/advisories/2006/2595 · Note
• http://securityreason.com/securityalert/1200 · Note
• http://securityfocus.com/archive/1/438710/100/0/threaded · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html · Note