====================================================================== Secunia Research 17/09/2012 - Novell GroupWise iCalendar Date/Time Parsing Denial of Service - ====================================================================== Table of Contents Affected Software....................................................1 Severity.............................................................2 Vendor's Description of Software.....................................3 Description of Vulnerability.........................................4 Solution.............................................................5 Time Table...........................................................6 Credits..............................................................7 References...........................................................8 About Secunia........................................................9 Verification........................................................10 ====================================================================== 1) Affected Software * Novell GroupWise 8.0.2 HP3 NOTE: Other versions may also be affected. ====================================================================== 2) Severity Rating: Moderately critical Impact: Denial of Service Where: Remote ====================================================================== 3) Vendor's Description of Software "Novell GroupWise 8 gives you a wide range of collaborative tools to create a truly plugged in work environment.". Product Link: http://www.novell.com/products/groupwise/ ====================================================================== 4) Description of Vulnerability Secunia Research has discovered a vulnerability in Novell GroupWise, which can be exploited by malicious people to cause a DoS (Denial of Service). Novell GroupWise includes the GroupWise Internet Agent (GWIA), which is responsible for exchanging e-mail messages between GroupWise and the Internet via e.g. IMAP4, POP3, and SMTP. The GroupWise Internet Agent also supports parsing of iCalendar data, which is implemented in gwwww1.dll. The iCalendar format is used to exchange calendar information and is comprised of various groupings of component properties. Some of these properties may include date-time information, which can e.g. be specified via the TZID parameter of a DTSTART property in a VTIMEZONE component. Date-Time information is formatted as: "[date]T[time]" where "[date]" is 8 characters and "[time]" is 6 characters (e.g. "20120915T230000" means September 15th, 2012 at 11 PM). NgwiCalTimeProperty::datetime() in gwwww1.dll is responsible for parsing date-time information. When called, the function in turn calls NgwiCalTimeProperty::date() to parse the date in the date-time string. Upon exiting, NgwiCalTimeProperty::date() returns a pointer to offset 8 into the date-time string (i.e. where the 'T' and following time information is expected to be). This returned pointer is then dereferenced in order to evaluate whether the referenced character is 'T' and parse the expected time information. However, no checks are performed by the function to ensure that the supplied date-time string is longer than 8 characters. This may result in an out-of-bounds read access violation, causing GWIA to crash in case a shorter date-time string was supplied via e.g. an e-mail with a specially crafted .ics attachment. ====================================================================== 5) Solution Update to version 8.0 Support Pack 3 or later. ====================================================================== 6) Time Table 20/10/2011 - Vendor notified. 20/10/2011 - Vendor response. 21/12/2011 - Vendor asks for additional information. 21/12/2011 - Clarification provided to the vendor. 21/12/2011 - Vendor response. 08/03/2012 - Vendor provides status update. 18/05/2012 - Vendor provides status update. 29/06/2012 - Status update requested. 29/06/2012 - Vendor provides status update. 06/08/2012 - Vendor provides status update. 13/09/2012 - Vendor provides status update. 14/09/2012 - Vendor provides status update. 17/09/2012 - Public disclosure. ====================================================================== 7) Credits Discovered by Carsten Eiram, Secunia Research. ====================================================================== 8) References The Common Vulnerabilities and Exposures (CVE) project has assigned CVE-2011-3827 for the vulnerability. Novell: http://www.novell.com/support/kb/doc.php?id=7010767 ====================================================================== 9) About Secunia Secunia offers vulnerability management solutions to corporate customers with verified and reliable vulnerability intelligence relevant to their specific system configuration: http://secunia.com/advisories/business_solutions/ Secunia also provides a publicly accessible and comprehensive advisory database as a service to the security community and private individuals, who are interested in or concerned about IT-security. http://secunia.com/advisories/ Secunia believes that it is important to support the community and to do active vulnerability research in order to aid improving the security and reliability of software in general: http://secunia.com/secunia_research/ Secunia regularly hires new skilled team members. Check the URL below to see currently vacant positions: http://secunia.com/corporate/jobs/ Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/advisories/mailing_lists/ ====================================================================== 10) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2012-30/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ======================================================================