PT-2013-2868 · Microsoft+1 · Windows+1

Published 2013-05-05 · Updated 2013-05-06 · CVE-2013-1092

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Novell ZENworks Desktop Management versions 7 through 7.1

Description The issue is related to unquoted Windows search path vulnerabilities, which might allow local users to gain privileges. This could occur via a Trojan horse "program" file in the C: folder, specifically when attempting to launch ZenRem32.exe or wm.exe.

Recommendations For Novell ZENworks Desktop Management versions 7 through 7.1, consider updating to a version that includes the necessary security fixes to prevent exploitation of the unquoted Windows search path vulnerabilities. As a temporary workaround, restrict access to the C: folder to minimize the risk of a Trojan horse program being placed there.

Fix

Related Identifiers

CVE-2013-1092

Affected Products

Novell Zenworks Desktop Management

Windows

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-1092 · Security Note
• http://novell.com/support/kb/doc.php?id=7012147 · Vendor Advisory
• http://download.novell.com/Download?buildid=hT-LlTRPOfw~ · Note