CVE-2013-3706

Name of the Vulnerable Software and Affected Versions Novell ZENworks Configuration Management version 11.2

Description The issue allows remote attackers to read arbitrary files via a .. (dot dot) in a preboot update pathname. This is a directory traversal vulnerability in the PreBoot service.

Recommendations For Novell ZENworks Configuration Management version 11.2, consider restricting access to the PreBoot service until a patch is available. As a temporary workaround, avoid using the PreBoot service for preboot updates that may contain malicious pathnames. At the moment, there is no information about a newer version that contains a fix for this vulnerability.