Privacy and Legal Notice
TECHNICAL BULLETIN
T-141: Novell GroupWise Buffer Overflow and Cross Site Scripting Vulnerabilities
[CVE-2009-1634, CVE-2009-1635 and CVE-2009-1636]
May 22, 2009 20:00 GMT
|
| PROBLEM: |
Multiple vulnerabilities have been identified in Novell GroupWise,
which could be exploited by remote attackers to bypass security restrictions, conduct phishing
attacks, cause a denial of service or compromise a vulnerable system.
|
| PLATFORM: |
Novell GroupWise version 7.03 HP2 and prior
Novell GroupWise version 8.0.0 HP1 and prior
|
| ABSTRACT: |
The first issue is caused by a buffer overflow error in the
Novell GroupWise Internet Agent (GWIA) when processing specially crafted email addresses via SMTP,
which could be exploited by remote unauthenticated attackers to execute arbitrary code with SYSTEM
privileges.
|
|
| IMPACT ASSESSMENT: |
The risk is high. Network exploit does not require authentication and difficulty of exploit is low. A successful exploitation of this vulnerability may allow an attacker unauthorized access to view or modify application and host operating system files. Replacement of system files could result in denial of service or complete compromise of system. |
|
[***** Start CVE-2009-1634, CVE-2009-1635 and CVE-2009-1636 *****]
Novell GroupWise Buffer Overflow and Cross Site Scripting Vulnerabilities
PLATFORM:
Novell GroupWise version 7.03 HP2 and prior
Novell GroupWise version 8.0.0 HP1 and prior
Multiple vulnerabilities have been identified in Novell GroupWise, which could be exploited by remote
attackers to bypass security restrictions, conduct phishing attacks, cause a denial of service or
compromise a vulnerable system.
The first issue is caused by a buffer overflow error in the Novell GroupWise Internet Agent (GWIA)
when processing specially crafted email addresses via SMTP, which could be exploited by remote
unauthenticated attackers to execute arbitrary code with SYSTEM privileges.
The second vulnerability is caused by a buffer overflow error in the Novell GroupWise Internet
Agent (GWIA) when processing certain SMTP requests, which could be exploited by remote unauthenticated
attackers to execute arbitrary code with SYSTEM privileges.
The third issue is caused by input validation errors in the GroupWise WebAccess, which could allow
attackers to use Javascript to deface the login page, preventing users from logging in to WebAccess.
The fourth vulnerability is caused by an error in the way GroupWise WebAccess blocks scripting, which
could be exploited by attackers to gain access to an authenticated user's mailbox and forward data
or requests to a malicious site.
The fifth issue is caused by errors within the session management mechanisms in the GroupWise WebAccess,
which could allow an attacker to gain access to an authenticated user's account.
The sixth vulnerability is caused by input validation errors in the GroupWise WebAccess within the
handling of style expressions, which could be exploited by attackers to redirect a user and/or
forward data or requests to a malicious site via a specially crafted message with an HTML file.
OTHER LINKS:
Vupen Security
http://www.vupen.com/english/advisories/2009/1393
CVE-2009-1634 - CVE-2009-1635 - CVE-2009-1636
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1634
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1635
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1636
Novell
http://www.novell.com/support/viewContent.do?externalId=7003273&sliceId=1
http://www.novell.com/support/viewContent.do?externalId=7003272&sliceId=1
http://www.novell.com/support/viewContent.do?externalId=7003271&sliceId=1
http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1
http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1
http://www.novell.com/support/viewContent.do?externalId=7003266&sliceId=1
Security Focus
http://www.securityfocus.com/bid/35065
http://www.securityfocus.com/bid/35064
SOLUTION:
Apply Novell GroupWise 7.03 Hot Patch 3 (HP3) and GroupWise 8.0 Hot Patch 2 (HP2) or later.
[***** End CVE-2009-1634, CVE-2009-1635 and CVE-2009-1636 *****]
DOE-CIRC wishes to acknowledge the contributions of Nicolas Joly (VUPEN Security),
Scott White (Secure State LLC), Gregory DuChemin, and Jim LaV for the information contained
in this bulletin.
DOECIRC services are available to DOE, DOE Contractors, and the NIH.
DOE-CIRC can be contacted at:
Voice: 866-941-2472
E-mail: doecirc@doecirc.energy.gov
World Wide Web: http://www.doecirc.energy.gov
UCRL-MI-119788