A vulnerability has been reported in LANDesk Management Gateway, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. inject and execute arbitrary shell commands if a logged-in administrator visits a specially crafted web site.

The vulnerability is reported in versions 4.2 GSBWEB v1.61 and 4.0 GSBWEB v1.61s. Other versions may also be affected.

Solution
Apply patch GSBWEB_62.

Provided and/or discovered by
Aureliano Calvo, Core Security Technologies

Original Advisory
LANDesk:
http://community.landesk.com/support/docs/DOC-21767

Core Security Technologies:
http://www.coresecurity.com/content/landesk-os-command-injection-vulnerability

Deep Links
Links available to Secunia VIM customers