Novell File Reporter 'NFRAgent.exe 'absolute Path Traversal Vulnerability

Release date:
Updated on: 2012-11-19

Affected Systems:
Novell File Reporter Agent 1.0.2
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56579
Cve id: CVE-2012-4957

Novell File Reporter is a component of Novell File Management Suite. A report used to identify files stored on the network and generate relevant usage information. It consists of a central Report Engine and multiple distributed agents (NFR Agent.

Novell File Reporter 1.0.2and its other nfragent.exe have the absolute PATH traversal vulnerability. This vulnerability allows remote attackers to read arbitrary files by sending/FSF/CMD requests with full PATH names in the PATH element in the SRS record.

<* Source: Juan Vazquez

Link: http://www.kb.cert.org/vuls/id/273371
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Novell
------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://support.novell.com/security-alerts