CVE:CVE-2006-3426
CNNVD:CNNVD-200607-056
(a) PatchLink Update Server (PLUS) 6.1 P1之前版本和6.2 SR1 P1 之前的6.2.x版本和(b) Novell ZENworks 6.2 SR1之前版本存在目录遍历漏洞。远程攻击者可以借助用作文件名组成部分的，对dagent/nwupload.asp的(1) action, (2) agentid,或(3) index参数（该参数中包含..）序列，重写任意文件或目录。
solution:Upgrade lumension patchlink_update_server to a higher version than 6.1,6.2.0.181,6.2.0.189,and avoid the version 6.1,6.2.0.181,6.2.0.189; Upgrade novell zenworks to a higher version than *:sr1,and avoid the version *:sr1