---------------------------------------------------------------------- Did you know that a change in our assessment rating, exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list? Click here to learn more: http://secunia.com/advisories/business_solutions/ ---------------------------------------------------------------------- TITLE: Novell GroupWise Multiple Vulnerabilities SECUNIA ADVISORY ID: SA33744 VERIFY ADVISORY: http://secunia.com/advisories/33744/ CRITICAL: Highly critical IMPACT: Security Bypass, Cross Site Scripting, DoS, System access WHERE: >From remote SOFTWARE: Novell GroupWise 8.x http://secunia.com/advisories/product/21283/ Novell GroupWise 7.x http://secunia.com/advisories/product/5667/ Novell Groupwise 6.x http://secunia.com/advisories/product/86/ DESCRIPTION: Some vulnerabilities have been reported in Novell GroupWise, which can be exploited by malicious people to conduct cross-site scripting, cross-site request forgery, and script insertion attacks, bypass certain security restrictions, or compromise a vulnerable system. 1) Input passed to the "User.id" and "Library.queryText" parameters in /gw/webacc is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML or script code in a user's browser session in context of an affected site. 2) Certain HTML emails or HTML attachments are not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious email is viewed. 3) A vulnerability is caused due to the application allowing the user to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to e.g. add a forwarding rule or change certain settings e.g. when a user visits a malicious web page. 4) A vulnerability is caused due to an error within the handling of HTTP POST requests. This can be exploited to convert POST requests into GET requests, which can be used to gain access to certain restricted GroupWise information. 5) An unspecified error exists within the Novell GroupWise Internet Agent (GWIA), which can be exploited to cause a buffer overflow and execute arbitrary code on a vulnerable system. The vulnerabilities are reported in GroupWise 6.5x, GroupWise 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and GroupWise 8.0. Other versions may also be affected. SOLUTION: Apply patches. Note: GroupWise 6.5x reached end of life status. The vendor recommends to upgrade to GroupWise 7.03 HP2 or 8.0 HP1 1) http://www.novell.com/support/viewContent.do?externalId=7002321 2) http://www.novell.com/support/viewContent.do?externalId=7002320 3) http://www.novell.com/support/viewContent.do?externalId=7002319 4) http://www.novell.com/support/viewContent.do?externalId=7002322 5) http://www.novell.com/support/viewContent.do?externalId=7002502 PROVIDED AND/OR DISCOVERED BY: 1) Richard Brain, ProCheckup Ltd 2, Jan Fry, ProCheckUp Ltd 3, 4) Adrian Pastor, ProCheckUp Ltd 5) The vendor credits Nick DeBaggis working with TippingPoint's Zero Day Initiative ORIGINAL ADVISORY: 1) http://www.novell.com/support/viewContent.do?externalId=7002321 http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-23 2) http://www.novell.com/support/viewContent.do?externalId=7002320 http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-22 3) http://www.novell.com/support/viewContent.do?externalId=7002319 http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-21 4) http://www.novell.com/support/viewContent.do?externalId=7002322 5) http://www.novell.com/support/viewContent.do?externalId=7002502 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------