CVE-2016-1608

HIGH

Novell Filr <2.0 - Authenticated RCE

Title source: llm

Description

vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ntpServer parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by SEC Consult · textwebappsjava

https://www.exploit-db.com/exploits/40161

View Code ZIP pw:eip

References (6)

[Mailing List] http://seclists.org/bugtraq/2016/Jul/119

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/92113

[Various Sources] https://download.novell.com/Download?buildid=3V-3ArYN85I~

[Various Sources] https://download.novell.com/Download?buildid=BOTiHcBFfv0~

[Vendor Advisory] https://www.novell.com/support/kb/doc.php?id=7017789

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/40161/

Scores

CVSS v3 8.8

EPSS 0.1060

EPSS Percentile 93.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-284

Status draft

Affected Products (2)

novell/filr < 1.2

novell/filr < 2.0

Timeline

Published Aug 01, 2016

Tracked Since Feb 18, 2026