Technical Description

Multiple vulnerabilities have been identified in Novell GroupWise, which could be exploited by remote attackers to bypass security restrictions, conduct phishing attacks, cause a denial of service or compromise a vulnerable system.

The first issue is caused by a buffer overflow error in the Novell GroupWise Internet Agent (GWIA) when processing specially crafted email addresses via SMTP, which could be exploited by remote unauthenticated attackers to execute arbitrary code with SYSTEM privileges.

The second vulnerability is caused by a buffer overflow error in the Novell GroupWise Internet Agent (GWIA) when processing certain SMTP requests, which could be exploited by remote unauthenticated attackers to execute arbitrary code with SYSTEM privileges.

The third issue is caused by input validation errors in the GroupWise WebAccess, which could allow attackers to use Javascript to deface the login page, preventing users from logging in to WebAccess.

The fourth vulnerability is caused by an error in the way GroupWise WebAccess blocks scripting, which could be exploited by attackers to gain access to an authenticated user's mailbox and forward data or requests to a malicious site.

The fifth issue is caused by errors within the session management mechanisms in the GroupWise WebAccess, which could allow an attacker to gain access to an authenticated user's account.

The sixth vulnerability is caused by input validation errors in the GroupWise WebAccess within the handling of style expressions, which could be exploited by attackers to redirect a user and/or forward data or requests to a malicious site via a specially crafted message with an HTML file.

Affected Products

Novell GroupWise version 7.03 HP2 and prior
Novell GroupWise version 8.0.0 HP1 and prior

Solution

Apply Novell GroupWise 7.03 Hot Patch 3 (HP3) and GroupWise 8.0 Hot Patch 2 (HP2) or later.

References

http://www.vupen.com/english/advisories/2009/1393
http://www.novell.com/support/viewContent.do?externalId=7003273&sliceId=1
http://www.novell.com/support/viewContent.do?externalId=7003272&sliceId=1
http://www.novell.com/support/viewContent.do?externalId=7003271&sliceId=1
http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1
http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1
http://www.novell.com/support/viewContent.do?externalId=7003266&sliceId=1

Credits

Vulnerabilities reported by Nicolas Joly (VUPEN Security), Scott White (Secure State LLC), Gregory DuChemin, and Jim LaValley (LaValley Consulting LLC).

ChangeLog

2009-05-22 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.