Details of VAR-200702-0422

ID

VAR-200702-0422

CVE

CVE-2007-1119

TITLE

Novell ZENworks 7 Desktop Management Support Pack 1 Vulnerabilities in uploading images to specific folders

Trust: 0.8

sources: JVNDB: JVNDB-2007-003430

DESCRIPTION

Unspecified vulnerability in Novell ZENworks 7 Desktop Management Support Pack 1 before Hot patch 3 (ZDM7SP1HP3) allows remote attackers to upload images to certain folders that were not configured in the "Only allow uploads to the following directories" setting via unspecified vectors. Novell Zenworks Desktop Management version 7 Support Pack 1 - ZDM7 SP1 and ZDM7 SP1 Imaging are vulnerable to this issue. ---------------------------------------------------------------------- Secunia is proud to announce the availability of the Secunia Software Inspector. The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor. SOLUTION: Apply ZDM7SP1HP3. http://download.novell.com/Download?buildid=GcDUupyC8Zg PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: https://secure-support.novell.com/KanisaPlatform/Publishing/408/3563780_f.SAL_Public.html https://secure-support.novell.com/KanisaPlatform/Publishing/650/3484245_f.SAL_Public.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.98

sources: NVD: CVE-2007-1119 // JVNDB: JVNDB-2007-003430 // BID: 22686 // PACKETSTORM: 54581

AFFECTED PRODUCTS

vendor:	novell	model:	zenworks	scope:	eq	version:	7	Trust: 1.6
vendor:	novell	model:	zenworks	scope:	eq	version:	hot patch 3 (zdm7sp1hp3)	Trust: 0.8
vendor:	novell	model:	zenworks	scope:	lt	version:	7 desktop management support pack 1	Trust: 0.8
vendor:	novell	model:	zenworks desktop management 7.zdm7 sp1 imaging	scope:	-	version:	-	Trust: 0.3
vendor:	novell	model:	zenworks desktop management 7.zdm7 sp1	scope:	-	version:	-	Trust: 0.3
vendor:	novell	model:	zenworks desktop management 7.zdm7sp1hp3	scope:	ne	version:	-	Trust: 0.3

sources: BID: 22686 // JVNDB: JVNDB-2007-003430 // NVD: CVE-2007-1119 // CNNVD: CNNVD-200702-496

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2007-1119
value:	MEDIUM
Trust: 1.8
CNNVD:	CNNVD-200702-496
value:	MEDIUM
Trust: 0.6

NVD:
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	FALSE
userInteractionRequired:	FALSE
version:	2.0
Trust: 1.0
NVD:	CVE-2007-1119
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

sources: JVNDB: JVNDB-2007-003430 // NVD: CVE-2007-1119 // CNNVD: CNNVD-200702-496

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2007-1119

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200702-496

TYPE

Design Error

Trust: 0.9

sources: BID: 22686 // CNNVD: CNNVD-200702-496

CONFIGURATIONS

sources: NVD: CVE-2007-1119

PATCH

title:

3484245

url:

http://www.novell.com/support/kb/doc.php?id=3484245

Trust: 0.8

sources: JVNDB: JVNDB-2007-003430

EXTERNAL IDS

db:	NVD	id:	CVE-2007-1119	Trust: 2.7
db:	BID	id:	22686	Trust: 1.9
db:	SECUNIA	id:	24274	Trust: 1.7
db:	OSVDB	id:	33533	Trust: 1.6
db:	VUPEN	id:	ADV-2007-0712	Trust: 1.6
db:	JVNDB	id:	JVNDB-2007-003430	Trust: 0.8
db:	CNNVD	id:	CNNVD-200702-496	Trust: 0.6
db:	PACKETSTORM	id:	54581	Trust: 0.1

sources: BID: 22686 // JVNDB: JVNDB-2007-003430 // PACKETSTORM: 54581 // NVD: CVE-2007-1119 // CNNVD: CNNVD-200702-496

REFERENCES

url:	https://secure-support.novell.com/kanisaplatform/publishing/408/3563780_f.sal_public.html	Trust: 2.0
url:	https://secure-support.novell.com/kanisaplatform/publishing/650/3484245_f.sal_public.html	Trust: 2.0
url:	http://osvdb.org/33533	Trust: 1.6
url:	http://secunia.com/advisories/24274	Trust: 1.6
url:	http://www.securityfocus.com/bid/22686	Trust: 1.6
url:	http://www.vupen.com/english/advisories/2007/0712	Trust: 1.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-1119	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-1119	Trust: 0.8
url:	http://www.frsirt.com/english/advisories/2007/0712	Trust: 0.6
url:	http://www.novell.com/products/zenworks/desktops/overview.html	Trust: 0.3
url:	http://secunia.com/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/about_secunia_advisories/	Trust: 0.1
url:	http://secunia.com/software_inspector/	Trust: 0.1
url:	http://secunia.com/advisories/24274/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/product/8524/	Trust: 0.1
url:	http://download.novell.com/download?buildid=gcduupyc8zg	Trust: 0.1

sources: BID: 22686 // JVNDB: JVNDB-2007-003430 // PACKETSTORM: 54581 // NVD: CVE-2007-1119 // CNNVD: CNNVD-200702-496

CREDITS

The vendor disclosed this issue.

Trust: 0.9

sources: BID: 22686 // CNNVD: CNNVD-200702-496

SOURCES

db:	BID	id:	22686
db:	JVNDB	id:	JVNDB-2007-003430
db:	PACKETSTORM	id:	54581
db:	NVD	id:	CVE-2007-1119
db:	CNNVD	id:	CNNVD-200702-496

LAST UPDATE DATE

2023-12-18T13:49:43.672000+00:00

SOURCES UPDATE DATE

db:	BID	id:	22686	date:	2015-05-12T19:34:00
db:	JVNDB	id:	JVNDB-2007-003430	date:	2012-09-25T00:00:00
db:	NVD	id:	CVE-2007-1119	date:	2011-03-08T02:51:20.143
db:	CNNVD	id:	CNNVD-200702-496	date:	2007-02-28T00:00:00

SOURCES RELEASE DATE

db:	BID	id:	22686	date:	2007-02-23T00:00:00
db:	JVNDB	id:	JVNDB-2007-003430	date:	2012-09-25T00:00:00
db:	PACKETSTORM	id:	54581	date:	2007-02-23T22:44:59
db:	NVD	id:	CVE-2007-1119	date:	2007-02-27T02:28:00
db:	CNNVD	id:	CNNVD-200702-496	date:	2007-02-26T00:00:00