CVE-2006-3425

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-07-07 · updated 2026-06-16

Description

FastPatch for (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1, and (b) Novell ZENworks 6.2 SR1 and earlier, does not require authentication for dagent/proxyreg.asp, which allows remote attackers to list, add, or delete PatchLink Distribution Point (PDP) proxy servers via modified (1) List, (2) Proxy, or (3) Delete parameters.

Affected products

Lumension Patchlink Update Server: 6.1, 6.2.0.181, 6.2.0.189
Novell Zenworks: through 6.2

References

http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html
http://secunia.com/advisories/20876
http://secunia.com/advisories/20878
http://securityreason.com/securityalert/1200
http://securitytracker.com/id?1016405
http://www.securityfocus.com/archive/1/438710/100/0/threaded
http://www.securityfocus.com/bid/18723
http://www.vupen.com/english/advisories/2006/2595
http://www.vupen.com/english/advisories/2006/2596
http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html
http://secunia.com/advisories/20876
http://secunia.com/advisories/20878

Get alerted when CVE-2006-3425 or the next vulnerability affects your stack