CVE-2006-3430

SQL injection vulnerability in checkprofile.asp in (1) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (2) Novell ZENworks 6.2 SR1 and earlier, allows remote attackers to execute arbitrary SQL commands via the agentid parameter.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://securitytracker.com/id?1016405
http://secunia.com/advisories/20876	Vendor Advisory
http://secunia.com/advisories/20878	Vendor Advisory
http://www.securityfocus.com/bid/18715
http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html
http://securityreason.com/securityalert/1200
http://www.vupen.com/english/advisories/2006/2595	Vendor Advisory
http://www.vupen.com/english/advisories/2006/2596	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27545
http://www.securityfocus.com/archive/1/438710/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:lumension:patchlink_update_server:6.1:::::::*
	cpe:2.3:a:novell:zenworks::sr1::::::*
	cpe:2.3:a:lumension:patchlink_update_server:6.2.0.181:::::::*
	cpe:2.3:a:lumension:patchlink_update_server:6.2.0.189:::::::*

Information

Published : 2006-07-06 17:05

Updated : 2018-10-18 09:47

NVD link : CVE-2006-3430

Mitre link : CVE-2006-3430

JSON object : View

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Advertisement

Products Affected

lumension

patchlink_update_server

novell

zenworks

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://securitytracker.com/id?1016405", "name": "1016405", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/20876", "name": "20876", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://secunia.com/advisories/20878", "name": "20878", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/18715", "name": "18715", "tags": [], "refsource": "BID"}, {"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html", "name": "20060629 Multiple Vulnerabilities in PatchLink Update Server 6", "tags": [], "refsource": "FULLDISC"}, {"url": "http://securityreason.com/securityalert/1200", "name": "1200", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2006/2595", "name": "ADV-2006-2595", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "http://www.vupen.com/english/advisories/2006/2596", "name": "ADV-2006-2596", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27545", "name": "patchlink-checkprofile-sql-injection(27545)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/438710/100/0/threaded", "name": "20060629 Multiple Vulnerabilities in PatchLink Update Server 6", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "SQL injection vulnerability in checkprofile.asp in (1) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (2) Novell ZENworks 6.2 SR1 and earlier, allows remote attackers to execute arbitrary SQL commands via the agentid parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-89"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-3430", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2006-07-07T00:05Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:lumension:patchlink_update_server:6.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:novell:zenworks:*:sr1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "6.2"}, {"cpe23Uri": "cpe:2.3:a:lumension:patchlink_update_server:6.2.0.181:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:lumension:patchlink_update_server:6.2.0.189:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-18T16:47Z"}