CVE-2006-3425: High severity Lumension Patchlink Update Server vulnerability
FastPatch for (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1, and (b) Novell ZENworks 6.2 SR1 and earlier, does not require authentication for dagent/proxyreg.asp, which allows remote attackers to list, add, or delete PatchLink Distribution Point (PDP) proxy servers via modified (1) List, (2) Proxy, or (3) Delete parameters.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-3425?
CVE-2006-3425 has a severity rating that indicates it can be exploited to gain unauthorized access to PatchLink Distribution Point proxy servers.
How do I fix CVE-2006-3425?
To fix CVE-2006-3425, update to Lumension PatchLink Update Server version 6.1 P1 or 6.2 SR1 P1, or a later version.
What impact does CVE-2006-3425 have on affected systems?
CVE-2006-3425 allows remote attackers to list, add, or delete PatchLink Distribution Point proxy servers without authentication.
Which software versions are affected by CVE-2006-3425?
CVE-2006-3425 affects Lumension PatchLink Update Server versions prior to 6.1 P1 and 6.2.x before 6.2 SR1 P1, as well as Novell ZENworks versions up to 6.2 SR1.
Is authentication required for exploiting CVE-2006-3425?
CVE-2006-3425 does not require authentication for accessing the vulnerable components, making it easier for attackers to exploit.