exploit the possibilities

Novell GroupWise Agents Arbitrary File Retrieval

Novell GroupWise Agents Arbitrary File Retrieval
Posted Sep 23, 2012
Authored by Digital Defense, r@b13$ | Site digitaldefense.net

The HTTP interfaces for Novell GroupWise 8.0.2 Post Office Agent, Message Transfer Agent, and GroupWise Internet Agent are vulnerable to an arbitrary file retrieval condition due to a failure to properly filter certain crafted directory traversal sequences. An unauthenticated remote attacker can leverage this flaw to retrieve files with the privileges of the vulnerable agent. Novell has provided solutions for this issue in the form of GroupWise 8.0 SP3 as well as in the latest GroupWise 2012 SP1 release.

tags | advisory, remote, web, arbitrary
advisories | CVE-2012-0419
MD5 | 8bd4686fbe15c89cc7898086897fe824

Novell GroupWise Agents Arbitrary File Retrieval

Change Mirror Download
Title
-----
DDIVRT-2012-42 Novell GroupWise Agents Arbitrary File Retrieval (CVE-2012-0419)

Severity
--------
High

Date Discovered
---------------
April 2, 2012

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: r@b13$

Vulnerability Description
-------------------------
The HTTP interfaces for Novell GroupWise 8.0.2 Post Office Agent,
Message Transfer Agent, and GroupWise Internet Agent are vulnerable to
an arbitrary file retrieval condition due to a failure to properly
filter certain crafted directory traversal sequences. An
unauthenticated remote attacker can leverage this flaw to retrieve
files with the privileges of the vulnerable agent.

Solution Description
--------------------
Novell has provided solutions for this issue in the form of GroupWise
8.0 SP3 as well as in the latest GroupWise 2012 SP1 release.

http://www.novell.com/support/kb/doc.php?id=7010772

Tested Systems / Software
-------------------------
Novell GroupWise 8.0.2 Post Office Agent
Novell GroupWise 8.0.2 Message Transfer Agent
Novell GroupWise 8.0.2 GroupWise Internet Agent

Vendor Contact
--------------
Vendor Name: Novell
Vendor Website: http://www.novell.com/

Login or Register to add favorites

File Archive:

September 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    20 Files
  • 2
    Sep 2nd
    15 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    4 Files
  • 5
    Sep 5th
    1 Files
  • 6
    Sep 6th
    1 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    27 Files
  • 9
    Sep 9th
    7 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    9 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    25 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    15 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    12 Files
  • 19
    Sep 19th
    1 Files
  • 20
    Sep 20th
    1 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    21 Files
  • 23
    Sep 23rd
    8 Files
  • 24
    Sep 24th
    15 Files
  • 25
    Sep 25th
    4 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close