----------------------------------------------------------------------


Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM) Beta.

Join the beta: 
http://secunia.com/products/corporate/vim/


----------------------------------------------------------------------

TITLE:
Novell GroupWise Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA40820

VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/40820/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=40820

RELEASE DATE:
2010-11-10

DISCUSS ADVISORY:
http://secunia.com/advisories/40820/#comments

AVAILABLE ON SITE AND IN CUSTOMER AREA:
 * Last Update
 * Popularity
 * Comments
 * Criticality Level
 * Impact
 * Where
 * Solution Status
 * Operating System / Software
 * CVE Reference(s)

http://secunia.com/advisories/40820/

ONLY AVAILABLE IN CUSTOMER AREA:
 * Authentication Level
 * Report Reliability
 * Secunia PoC
 * Secunia Analysis
 * Systems Affected
 * Approve Distribution
 * Remediation Status
 * Secunia CVSS Score
 * CVSS

https://ca.secunia.com/?page=viewadvisory&vuln_id=40820

ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
 * AUTOMATED SCANNING

http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

DESCRIPTION:
Multiple vulnerabilities have been reported in Novell GroupWise,
which can be exploited by malicious users to disclose sensitive
information or compromise a vulnerable system, and by malicious
people to disclose sensitive information, conduct spoofing attacks,
or compromise a vulnerable system.

1) An input validation error in the WebAccess Agent and the Document
Viewer Agent can be exploited to download arbitrary local files via
directory traversal attacks.

Successful exploitation of the WebAccess Agent requires
authentication.

2) A boundary error exists within gwia.exe in the parsing of entities
in Content-Type headers in received e-mail messages, which can be
exploited to cause a stack-based buffer overflow.

3) A boundary error exists within gwia.exe in the parsing of
Content-Type headers in received e-mail messages, which can be
exploited to cause a stack-based buffer overflow.

4) A boundary error exists in the parsing of VCALENDAR data within
gwwww1.dll when processing a RRULE variable, which can be exploited
to cause a buffer overflow via a specially crafted e-mail message.

5) A boundary error exists in the parsing of VCALENDAR data within
gwwww1.dll when processing a COMMENT variable, which can be exploited
to cause a buffer overflow via a specially crafted e-mail message.

6) An error exists in the handling of signed integers in the parsing
Content-Type headers within gwia.exe, which can be exploited to cause
a stack-based buffer overflow via a specially crafted e-mail message.

7) A boundary error exists in the parsing of VCALENDAR data within
gwwww1.dll when processing a TZNAME variable, which can be exploited
to cause a buffer overflow via a specially crafted e-mail message.

8) An error in the handling of IMAP LIST commands can be exploited to
trigger a double-free condition by passing a large parameter to the
affected command.

9) A boundary error in the IMAP services can be exploited to cause a
stack-based buffer overflow via a specially crafted LIST or LSUB
request.

Successful exploitation of this vulnerability requires
authentication.

10) An unspecified error exists in the HTTP interfaces for the
GroupWise agents (Message Transfer Agent, Post Office Agent, Internet
Agent, WebAccess Agent, Monitor Agent).

Successful exploitation of vulnerabilities #2 to #10 may allow
execution of arbitrary code.

11) Unspecified Input passed to the WebPublisher component of
GroupWise WebAccess is not properly sanitised before being used. This
can be exploited to e.g. redirect users to an untrusted fake site.

SOLUTION:
Apply the hot patch.

Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

PROVIDED AND/OR DISCOVERED BY:
1) Mehul Revankar, reported through Secunia
2-7) Anonymous, reported via ZDI
8) Francis Provencher, reported via ZDI
9) Francis Provencher, Protek Research Lab's
10) The vendor credits Anonymous, working with ZDI
11) The vendor credits Pat Bergoch at Amerimark

ORIGINAL ADVISORY:
Novell:
http://www.novell.com/support/viewContent.do?externalId=7007152
http://www.novell.com/support/viewContent.do?externalId=7007156
http://www.novell.com/support/viewContent.do?externalId=7007153
http://www.novell.com/support/viewContent.do?externalId=7007155
http://www.novell.com/support/viewContent.do?externalId=7007154
http://www.novell.com/support/viewContent.do?externalId=7007151
http://www.novell.com/support/viewContent.do?externalId=7007157
http://www.novell.com/support/viewContent.do?externalId=7007159
http://www.novell.com/support/viewContent.do?externalId=7007158

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-237/
http://www.zerodayinitiative.com/advisories/ZDI-10-238/
http://www.zerodayinitiative.com/advisories/ZDI-10-239/
http://www.zerodayinitiative.com/advisories/ZDI-10-240/
http://www.zerodayinitiative.com/advisories/ZDI-10-241/
http://www.zerodayinitiative.com/advisories/ZDI-10-242/
http://www.zerodayinitiative.com/advisories/ZDI-10-243/

OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------