CVE-2012-5930
NetIQ Privileged User Manager < 2.3.1 HF2 - Unauthenticated Password Change via AMF Request
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2012-5930.
AI-analyzed exploit summary This exploit demonstrates a pre-authentication remote code execution vulnerability in Novell NetIQ Privileged User Manager 2.3.1. It leverages a flaw in the `pa_modify_accounts()` function within `auth.dll` to change the admin password without authentication, then uses a post-authentication flaw in `set_log_config()` to write arbitrary files and achieve SYSTEM-level command execution.
Description
The pa_modify_accounts function in auth.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 does not require authentication for the modifyAccounts method, which allows remote attackers to change the passwords of administrative accounts via a crafted application/x-amf request.
Exploits (1)
This exploit demonstrates a pre-authentication remote code execution vulnerability in Novell NetIQ Privileged User Manager 2.3.1. It leverages a flaw in the `pa_modify_accounts()` function within `auth.dll` to change the admin password without authentication, then uses a post-authentication flaw in `set_log_config()` to write arbitrary files and achieve SYSTEM-level command execution.