CVE-2010-2892: Input Validation
First published: Mon Nov 15 2010(Updated: )
gsb/drivers.php in LANDesk Management Gateway 4.0 through 4.0-1.48 and 4.2 through 4.2-1.8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the DRIVES parameter, as demonstrated by a cross-site request forgery (CSRF) attack.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ivanti LANDESK Management Suite | =4.0-1.48 | |
| Ivanti LANDESK Management Suite | =4.2 | |
| Ivanti LANDESK Management Suite | =4.0 | |
| Ivanti LANDESK Management Suite | =4.2-1.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://community.landesk.com/support/docs/DOC-21767
- http://www.vupen.com/english/advisories/2010/2957
- http://www.coresecurity.com/content/landesk-os-command-injection-vulnerability
- http://www.securityfocus.com/bid/44781
- http://secunia.com/advisories/42188
- http://www.exploit-db.com/exploits/15488
- http://securitytracker.com/id?1024728
- http://www.securityfocus.com/archive/1/514728/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2010-2892?
CVE-2010-2892 is considered a high severity vulnerability due to the potential for remote command execution.
How do I fix CVE-2010-2892?
To fix CVE-2010-2892, upgrade to a version of LANDesk Management Gateway that is not affected by this vulnerability.
What types of systems are affected by CVE-2010-2892?
CVE-2010-2892 affects LANDesk Management Gateway versions 4.0 through 4.0-1.48 and 4.2 through 4.2-1.8.
Can CVE-2010-2892 be exploited remotely?
Yes, CVE-2010-2892 can be exploited remotely by authenticated administrators using cross-site request forgery techniques.
What impact does CVE-2010-2892 have on the affected systems?
CVE-2010-2892 allows attackers to execute arbitrary commands on the affected systems, which can lead to data breaches or system compromise.
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/landesk
- canonical/ivanti landesk management suite
- version/ivanti landesk management suite/4.0-1.48
- version/ivanti landesk management suite/4.2
- version/ivanti landesk management suite/4.0
- version/ivanti landesk management suite/4.2-1.8