---------------------------------------------------------------------- Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM) Beta. Join the beta: http://secunia.com/products/corporate/vim/ ---------------------------------------------------------------------- TITLE: Novell GroupWise Multiple Vulnerabilities SECUNIA ADVISORY ID: SA40820 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/40820/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=40820 RELEASE DATE: 2010-11-10 DISCUSS ADVISORY: http://secunia.com/advisories/40820/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/40820/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=40820 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in Novell GroupWise, which can be exploited by malicious users to disclose sensitive information or compromise a vulnerable system, and by malicious people to disclose sensitive information, conduct spoofing attacks, or compromise a vulnerable system. 1) An input validation error in the WebAccess Agent and the Document Viewer Agent can be exploited to download arbitrary local files via directory traversal attacks. Successful exploitation of the WebAccess Agent requires authentication. 2) A boundary error exists within gwia.exe in the parsing of entities in Content-Type headers in received e-mail messages, which can be exploited to cause a stack-based buffer overflow. 3) A boundary error exists within gwia.exe in the parsing of Content-Type headers in received e-mail messages, which can be exploited to cause a stack-based buffer overflow. 4) A boundary error exists in the parsing of VCALENDAR data within gwwww1.dll when processing a RRULE variable, which can be exploited to cause a buffer overflow via a specially crafted e-mail message. 5) A boundary error exists in the parsing of VCALENDAR data within gwwww1.dll when processing a COMMENT variable, which can be exploited to cause a buffer overflow via a specially crafted e-mail message. 6) An error exists in the handling of signed integers in the parsing Content-Type headers within gwia.exe, which can be exploited to cause a stack-based buffer overflow via a specially crafted e-mail message. 7) A boundary error exists in the parsing of VCALENDAR data within gwwww1.dll when processing a TZNAME variable, which can be exploited to cause a buffer overflow via a specially crafted e-mail message. 8) An error in the handling of IMAP LIST commands can be exploited to trigger a double-free condition by passing a large parameter to the affected command. 9) A boundary error in the IMAP services can be exploited to cause a stack-based buffer overflow via a specially crafted LIST or LSUB request. Successful exploitation of this vulnerability requires authentication. 10) An unspecified error exists in the HTTP interfaces for the GroupWise agents (Message Transfer Agent, Post Office Agent, Internet Agent, WebAccess Agent, Monitor Agent). Successful exploitation of vulnerabilities #2 to #10 may allow execution of arbitrary code. 11) Unspecified Input passed to the WebPublisher component of GroupWise WebAccess is not properly sanitised before being used. This can be exploited to e.g. redirect users to an untrusted fake site. SOLUTION: Apply the hot patch. Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ PROVIDED AND/OR DISCOVERED BY: 1) Mehul Revankar, reported through Secunia 2-7) Anonymous, reported via ZDI 8) Francis Provencher, reported via ZDI 9) Francis Provencher, Protek Research Lab's 10) The vendor credits Anonymous, working with ZDI 11) The vendor credits Pat Bergoch at Amerimark ORIGINAL ADVISORY: Novell: http://www.novell.com/support/viewContent.do?externalId=7007152 http://www.novell.com/support/viewContent.do?externalId=7007156 http://www.novell.com/support/viewContent.do?externalId=7007153 http://www.novell.com/support/viewContent.do?externalId=7007155 http://www.novell.com/support/viewContent.do?externalId=7007154 http://www.novell.com/support/viewContent.do?externalId=7007151 http://www.novell.com/support/viewContent.do?externalId=7007157 http://www.novell.com/support/viewContent.do?externalId=7007159 http://www.novell.com/support/viewContent.do?externalId=7007158 ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-237/ http://www.zerodayinitiative.com/advisories/ZDI-10-238/ http://www.zerodayinitiative.com/advisories/ZDI-10-239/ http://www.zerodayinitiative.com/advisories/ZDI-10-240/ http://www.zerodayinitiative.com/advisories/ZDI-10-241/ http://www.zerodayinitiative.com/advisories/ZDI-10-242/ http://www.zerodayinitiative.com/advisories/ZDI-10-243/ OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------