Description
FastPatch for (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1, and (b) Novell ZENworks 6.2 SR1 and earlier, does not require authentication for dagent/proxyreg.asp, which allows remote attackers to list, add, or delete PatchLink Distribution Point (PDP) proxy servers via modified (1) List, (2) Proxy, or (3) Delete parameters.
References
- 20060629 Multiple Vulnerabilities in PatchLink Update Server 6 mailing-list
- 20060629 Multiple Vulnerabilities in PatchLink Update Server 6 mailing-list
- 20876 third-party-advisory
- 20878 third-party-advisory
- 1200 third-party-advisory
- ADV-2006-2596 vdb-entry
- ADV-2006-2595 vdb-entry
- 1016405 vdb-entry
- 18723 vdb-entry