critical10.0Public exploit code
CVE-2012-4959
Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to upload and execute files via a 130 /FSF/CMD request …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution2012-12-12 · remote · windows · Verified
- Novell File Reporter (NFR) Agent FSFUI Record - Arbitrary File Upload / Remote Code Execution (Metasploit)2012-11-19 · remote · windows · Verified
Impact
Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to upload and execute files via a 130 /FSF/CMD request with a .. (dot dot) in a FILE element of an FSFUI record.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Novell | File Reporter | Version 1.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.kb.cert.org/vuls/id/273371
- https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
- http://www.kb.cert.org/vuls/id/273371
- https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959