Novell ZENworks Configuration Management PreBoot Service Opcode 0x21 Arbitrary File Download Vulnerability
03.14.12
BACKGROUND

ZENworks Configuration Management is an endpoint management solution. It is used to inventory assets (computers), deploy software and patches, and administer client computers from a centralized management console. The software suite consists of numerous system services, one of which is the Preboot Service. This is used to perform imaging operations on client disks before boot time.
DESCRIPTION

Remote exploitation of a file download vulnerability could allow an attacker to steal sensitive information from the target system.

The vulnerability occurs when processing incoming requests to the Preboot Service. The request contains binary opcodes used to specify different functionality, and ascii/binary arguments to these commands. Using the opcode 0x21, it is possible to use a directory traversal attack to specify the path of an arbitrary file on the file system. The content of this file will be read in, and sent back to the attacker. On Windows, the service runs with the privileges of a special Novell user, which is a member of the Administrators group. This allows read access to most files on the file system.
ANALYSIS

Exploitation of this vulnerability results in the disclosure of sensitive information. In order to exploit this vulnerability, an attacker needs the ability to connect to the target over ports 3037. No authentication is necessary. Exploitation is trivial and reliable, as an attacker simply provides the path to the desired file and then reads it back.
DETECTION

iDefense has confirmed the existence of this vulnerability in ZENworks Configuration Management version 11.0.0.1992 on the Windows platform.
WORKAROUND

If remote imaging is not being used, then the Preboot Service can be disabled with the following command:

net stop "Novell ZENworks Preboot Service"

This will prevent exploitation of the vulnerability.
VENDOR RESPONSE

Novell has released patches and workarounds to address this vulnerability. For more information, consult their advisory at the following URL.

http://www.novell.com/support/search.do?cmd=displayKC&docType;=kc&externalId;=InfoDocument-patchbuilder-readme5127930&sliceId;=&docTypeID;=DT_SUSESDB_PSDB_1_1&dialogID;=1000895&stateId;=0%200%201004847
CVE INFORMATION

A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not been assigned yet.
DISCLOSURE TIMELINE

08/10/2011 Initial Vendor Notification
08/11/2011 Initial Vendor Reply
03/14/2012 Coordinated Public Disclosure
CREDIT

This vulnerability was reported to iDefense by Luigi Auriemma.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

LEGAL NOTICES

Copyright © 2012 Verisign, Inc.

Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customer service for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.