CIRT.DK Advisory
27/10/05, 19:10
The Novell ZENworks Patch Management Server 6.0.0.52 is vulnerable to=20
SQL injection in the management console.
To being able to exploit this issue the administrator have to=20
manually created a none-privileged account as minimum, to allow
exploitation.
Fix:=09
Upgrade to ZENworks Patch Management version 6.2.2.181
(or newer hot fix via your PLUS server) found at =
http://download.novell.com.
Note:=09
The 6.0.0.52 CD ISO image was on the Novell download site up until the =
2nd
week of September, 2005.=20
The ZENworks Patch Management CD ISO image that is currently available =
at
the download site at the=20
time of this document being published
http://download.novell.com/Download?buildid=3D5_kRStyf9wU~=20
ISO Name: ZEN_PatchMgmt_Upd6.2.iso Size: 323.8 MB
(339607552) MD5: aeb244ecdf29c83cb8388fae1a6a1919=20
A technical description of the vulnerability can be read at:=20
http://www.cirt.dk
SQL injection in the management console.
To being able to exploit this issue the administrator have to=20
manually created a none-privileged account as minimum, to allow
exploitation.
Fix:=09
Upgrade to ZENworks Patch Management version 6.2.2.181
(or newer hot fix via your PLUS server) found at =
http://download.novell.com.
Note:=09
The 6.0.0.52 CD ISO image was on the Novell download site up until the =
2nd
week of September, 2005.=20
The ZENworks Patch Management CD ISO image that is currently available =
at
the download site at the=20
time of this document being published
http://download.novell.com/Download?buildid=3D5_kRStyf9wU~=20
ISO Name: ZEN_PatchMgmt_Upd6.2.iso Size: 323.8 MB
(339607552) MD5: aeb244ecdf29c83cb8388fae1a6a1919=20
A technical description of the vulnerability can be read at:=20
http://www.cirt.dk