Secunia

Multiple vulnerabilities have been reported in Novell ZENworks Configuration Management, which can be exploited by malicious people to disclose potentially sensitive information, conduct cross-site scripting attacks, or compromise a vulnerable system.

1) A boundary error within Imaging of Preboot Service (novell-pbserv.exe) can be exploited to cause a stack-based buffer overflow via a specially crafted request sent to TCP port 998.

2) An error in the UploadServlet within Remote Management of ZENworks Server (zenserver.exe) can be exploited to upload a file to an arbitrary directory (e.g. the web root).

Successful exploitation may allow execution of arbitrary code in the context of the ZENworks Server.

3) An unspecified error can be exploited to browse certain web directories. No further information is currently available.

4) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Solution
Update to version 10.3.

Provided and/or discovered by
1, 2) Stephen Fewer of Harmony Security, reported via ZDI.
3, 4) Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
Novell:
http://www.novell.com/support/viewContent.do?externalId=7005572
http://www.novell.com/support/viewContent.do?externalId=7005573
http://www.novell.com/support/viewContent.do?externalId=7005455

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-078/
http://www.zerodayinitiative.com/advisories/ZDI-10-090/

Deep Links
Links available in Customer Area