CVE-2010-4229

Directory traversal vulnerability in an unspecified servlet in the Inventory component in ZENworks Asset Management (ZAM) in Novell ZENworks Configuration Management 10.3 before 10.3.2, and 11, allows remote attackers to overwrite files, and subsequently execute arbitrary code, via directory traversal sequences in a filename field in an upload request.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://securitytracker.com/id?1025313
http://www.novell.com/support/viewContent.do?externalId=7007841	Vendor Advisory
http://secunia.com/advisories/44120	Vendor Advisory
http://www.vupen.com/english/advisories/2011/0917	Vendor Advisory
http://zerodayinitiative.com/advisories/ZDI-11-118/
http://www.securityfocus.com/bid/47295
http://securityreason.com/securityalert/8207
https://exchange.xforce.ibmcloud.com/vulnerabilities/66656
http://www.securityfocus.com/archive/1/517425/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:novell:zenworks_configuration_management:10.3.1:::::::*
	cpe:2.3:a:novell:zenworks_configuration_management:11:::::::*
	cpe:2.3:a:novell:zenworks_configuration_management:10.3:::::::*

Information

Published : 2011-04-18 11:55

Updated : 2018-10-10 13:07

NVD link : CVE-2010-4229

Mitre link : CVE-2010-4229

JSON object : View

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Advertisement

Products Affected

novell

zenworks_configuration_management

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://securitytracker.com/id?1025313", "name": "1025313", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.novell.com/support/viewContent.do?externalId=7007841", "name": "http://www.novell.com/support/viewContent.do?externalId=7007841", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/44120", "name": "44120", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2011/0917", "name": "ADV-2011-0917", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "http://zerodayinitiative.com/advisories/ZDI-11-118/", "name": "http://zerodayinitiative.com/advisories/ZDI-11-118/", "tags": [], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/47295", "name": "47295", "tags": [], "refsource": "BID"}, {"url": "http://securityreason.com/securityalert/8207", "name": "8207", "tags": [], "refsource": "SREASON"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66656", "name": "zenworks-zam-code-execution(66656)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/517425/100/0/threaded", "name": "20110411 ZDI-11-118: Novell ZENworks Asset Management Path Traversal File Overwrite Remote Code Execution Vulnerability", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Directory traversal vulnerability in an unspecified servlet in the Inventory component in ZENworks Asset Management (ZAM) in Novell ZENworks Configuration Management 10.3 before 10.3.2, and 11, allows remote attackers to overwrite files, and subsequently execute arbitrary code, via directory traversal sequences in a filename field in an upload request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-22"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2010-4229", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2011-04-18T18:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:novell:zenworks_configuration_management:10.3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:novell:zenworks_configuration_management:11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:novell:zenworks_configuration_management:10.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-10T20:07Z"}