CVE-2006-3426: Medium severity Lumension Patchlink Update Server vulnerability
Directory traversal vulnerability in (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (b) Novell ZENworks 6.2 SR1 and earlier allows remote attackers to overwrite arbitrary files and directories via a .. (dot dot) sequence in the (1) action, (2) agentid, or (3) index parameters to dagent/nwupload.asp, which are used as pathname components.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-3426?
CVE-2006-3426 is considered to be a high severity vulnerability due to its potential for file and directory overwrite by remote attackers.
How do I fix CVE-2006-3426?
To fix CVE-2006-3426, update the PatchLink Update Server to version 6.1 P1 or later, or to version 6.2 SR1 P1 or later for Novell ZENworks.
What types of software are affected by CVE-2006-3426?
CVE-2006-3426 affects Lumension PatchLink Update Server versions 6.1 and 6.2, and Novell ZENworks 6.2 SR1 and earlier.
Can CVE-2006-3426 be exploited remotely?
Yes, CVE-2006-3426 can be exploited remotely using directory traversal techniques.
What are the potential consequences of CVE-2006-3426 exploitation?
Exploitation of CVE-2006-3426 could allow attackers to overwrite arbitrary files and directories, potentially leading to further compromise of the system.