CVE-2012-5931 in NetIQ
Summary
by MITRE
Directory traversal vulnerability in the set_log_config function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote authenticated users to create or overwrite arbitrary files via directory traversal sequences in a log pathname.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2025
The vulnerability identified as CVE-2012-5931 represents a critical directory traversal flaw within the NetIQ Privileged User Manager 2.3.x series, specifically affecting the regclnt.dll component used by unifid.exe service. This directory traversal vulnerability exists in the set_log_config function which processes log pathnames without adequate input validation or sanitization mechanisms. The flaw allows authenticated remote attackers to manipulate file system operations by crafting malicious log pathnames containing directory traversal sequences such as ../ or ..\ which can bypass normal file access controls and permissions.
The technical implementation of this vulnerability stems from insufficient validation of user-supplied input within the logging configuration functionality. When the set_log_config function processes a log pathname parameter, it fails to properly sanitize or validate the input before using it in file system operations. This allows an authenticated attacker to specify arbitrary file paths that can result in either the creation of new files in unintended locations or the overwriting of existing system files with malicious content. The vulnerability specifically affects versions prior to 2.3.1 HF2 of the NetIQ Privileged User Manager, indicating this was a known issue that required a specific hotfix to address the underlying code flaw.
The operational impact of this vulnerability is significant as it provides authenticated remote attackers with the ability to perform arbitrary file system operations on the affected system. An attacker could potentially overwrite critical system files, create backdoor executables, or manipulate log files to hide malicious activities. This vulnerability directly relates to CWE-22 which describes improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks. The attack vector requires authentication, which reduces the attack surface but does not eliminate the risk as authenticated users may include compromised accounts or insiders with legitimate access.
From a cybersecurity perspective, this vulnerability aligns with several ATT&CK techniques including T1078 Valid Accounts for maintaining persistence and T1566 Phishing for initial access. The ability to write arbitrary files makes this vulnerability particularly dangerous as it can be leveraged to establish persistence mechanisms or escalate privileges within the system. Organizations using NetIQ Privileged User Manager should immediately implement the available patch or hotfix (2.3.1 HF2) to resolve this issue. Additional mitigations include implementing network segmentation to limit access to the affected service, restricting authentication mechanisms, and monitoring for unusual file system activities in log directories. The vulnerability demonstrates the importance of proper input validation and the principle of least privilege in system design, as well as the critical need for timely patch management to address known security flaws.