Novell Home

My Favorites

Close

Please to see your favorites.

Security Vulnerability: NetIQ Privileged User Manager Remote Code Execution Vulnerability

This document (7011385) is provided subject to the disclaimer at the end of this document.

Environment

NetIQ Privileged User Manager 2.3.0
NetIQ Privileged User Manager 2.3.1

Situation

Privileged User Manager is vulnerable to an exploit whereby an attacker could, without prior authentication, change the password of the admin user and/or execute a Perl script with SYSTEM privileges.

Resolution

To resolve this issue, apply NetIQ Privileged User Manager 2.3.2 or later.
 
All versions of Privileged User Manager are affected by this vulnerability.

Customers using earlier versions of Privileged User Manager should upgrade their software to at least version 2.3.2 in order to fully secure their system. 

A short term alternative solution is to manually edit the following files:

UNIFI_ROOT/service/local/auth/module.xml

From:
<Method name="modifyAccounts" svc="pa_modify_accounts" master="1"/>
To:
<Method name="modifyAccounts" svc="pa_modify_accounts"  role.0="admin"
role.1="helpdesk" master="1"/>

UNIFI_ROOT/service/local/ldapagnt/module.xml
From:
<Method name="eval" svc="ldapagnt_eval" />
To:
<Method name="eval" svc="ldapagnt_eval" role="admin"/>

However it is advised to update to Privileged User Manager 2.3.2 (or later) as soon as possible.

Status

Security Alert

Additional Information

NetIQ credits Andrea Micalizzi (aka rgod) for reporting this flaw.

CVE-2012-5930
CVE-2012-5931
CVE-2012-5932

Disclaimer

This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:7011385
  • Creation Date:15-NOV-12
  • Modified Date:28-MAR-13
    • NetIQPrivileged User Manager

Did this document solve your problem? Provide Feedback