Unscored severity · published Jul 7, 2006
CVE-2006-3425
FastPatch for (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1, and (b) Novell ZENworks 6.2 SR1 and earlier, does not require authentication for…
–
CVSS
2.3%
EPSS
No
On KEV
Description
FastPatch for (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1, and (b) Novell ZENworks 6.2 SR1 and earlier, does not require authentication for dagent/proxyreg.asp, which allows remote attackers to list, add, or delete PatchLink Distribution Point (PDP) proxy servers via modified (1) List, (2) Proxy, or (3) Delete parameters.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Patchlink Update Server · Lumension
6.1; 6.2.0.181; 6.2.0.189 · source: NVD
ZE
Zenworks · Novell
through 6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3425
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3425
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html
Patch
http://secunia.com/advisories/20876
Patch
http://secunia.com/advisories/20878
securityreason.com
http://securityreason.com/securityalert/1200
Patch
http://securitytracker.com/id?1016405
www.securityfocus.com
http://www.securityfocus.com/archive/1/438710/100/0/threaded
More from Patchlink Update Server
–
CVE-2006-3426
Directory traversal vulnerability in (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (b) Novell ZENworks 6.2 SR1 and earlier allows remote…
–
CVE-2006-3430
SQL injection vulnerability in checkprofile.asp in (1) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (2) Novell ZENworks 6.2 SR1 and earlier, allows…