Novell Groupwise Multiple Vulnerabilities

[Peaches]

Novell GroupWise Multiple Vulnerabilities

Secunia Advisory: SA33744

Release Date: 2009-02-02

Critical:

Highly critical Impact: Security Bypass

Cross Site Scripting

DoS

System access

Where: From remote Solution Status: Vendor Patch

Software: Novell Groupwise 6.x

Novell GroupWise 7.x

Novell GroupWise 8.x

Subscribe: Instant alerts on relevant vulnerabilities

CVE reference: CVE-2009-0272

CVE-2009-0273

CVE-2009-0274

Description:

Some vulnerabilities have been reported in Novell GroupWise, which can be exploited by malicious people to conduct cross-site scripting, cross-site request forgery, and script insertion attacks, bypass certain security restrictions, or compromise a vulnerable system.

1) Input passed to the "User.id" and "Library.queryText" parameters in /gw/webacc is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML or script code in a user's browser session in context of an affected site.

2) Certain HTML emails or HTML attachments are not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious email is viewed.

3) A vulnerability is caused due to the application allowing the user to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to e.g. add a forwarding rule or change certain settings e.g. when a user visits a malicious web page.

4) A vulnerability is caused due to an error within the handling of HTTP POST requests. This can be exploited to convert POST requests into GET requests, which can be used to gain access to certain restricted GroupWise information.

5) An unspecified error exists within the Novell GroupWise Internet Agent (GWIA), which can be exploited to cause a buffer overflow and execute arbitrary code on a vulnerable system.

The vulnerabilities are reported in GroupWise 6.5x, GroupWise 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and GroupWise 8.0. Other versions may also be affected.

Solution:

Apply patches. Secunia - http://secunia.com/advisories/33744/