Description
Directory traversal vulnerability in (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (b) Novell ZENworks 6.2 SR1 and earlier allows remote attackers to overwrite arbitrary files and directories via a .. (dot dot) sequence in the (1) action, (2) agentid, or (3) index parameters to dagent/nwupload.asp, which are used as pathname components.
References
- 20060629 Multiple Vulnerabilities in PatchLink Update Server 6 mailing-list
- 18732 vdb-entry
- 20060629 Multiple Vulnerabilities in PatchLink Update Server 6 mailing-list
- 20876 third-party-advisory
- 20878 third-party-advisory
- 1200 third-party-advisory
- ADV-2006-2596 vdb-entry
- ADV-2006-2595 vdb-entry
- 1016405 vdb-entry