Novell NetMail Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence

Novell NetMail Multiple Vulnerabilities
Secunia Advisory:	SA15644	Advisory Toolbox: Issue ticket Save in to-do list Mark as handled Exploit information Download as PDF Review actions Add comment
Release Date:	2005-06-10
Last Update:	2005-09-02
Popularity:	7,386 views

Critical:	Moderately critical
Impact:	Cross Site Scripting System access
Where:	From remote
Solution Status:	Vendor Patch

Software:	Novell NetMail 3.x

Subscribe:	Instant alerts on relevant vulnerabilities

CVE reference:	CVE-2005-1756 CVE-2005-1757 CVE-2005-1758

Description: Various vulnerabilities have been reported in NetMail, which can be exploited by malicious people to conduct cross-site scripting attacks or compromise a vulnerable system. 1) Input passed to various calendar display fields in the Modweb agent is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 2) An unspecified boundary error when processing a very large name on folder rename through the WebAccess or WebMail client can cause a buffer overflow. 3) Unspecified boundary errors in the handling of long command tags in the IMAP agent can cause heap-based buffer overflows. 4) An integer overflow error in the IMAP command continuation function can cause a heap-based buffer overflow and allows execution of arbitrary code. Solution: Update to version 3.52C. NetWare: http://support.novell.com/servlet/filedownload/sec/pub/netmail352c_nw.zip Windows: http://support.novell.com/servlet/filedownload/sec/pub/netmail352c_win.zip Linux: http://support.novell.com/servlet/filedownload/sec/pub/netmail352c_lin.tgz Provided and/or discovered by: 1-3) Reported by vendor. 4) Pedram Amini, OpenRCE. Changelog: 2005-06-21: Updated advisory. 2005-09-02: Added additional information from iDEFENSE. Original Advisory: Novell: http://support.novell.com/cgi-bin/search/searchtid.cgi?/10097957.htm iDEFENSE: http://www.idefense.com/application/poi/display?id=301&type=vulnerabilities

Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released. Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Latest Advisories

Today

New advisories:	8
New vulnerabilities:	27
Updated advisories:	11

Moderately // 59 views

PHP Realtor "v_cat" SQL Injection Vulnerability

Highly // 117 views

Opera Multiple Vulnerabilities

Moderately // 88 views

Hero DVD Player M3U Processing Buffer Overflow Vulnerability

Moderately // 88 views

Red Hat update for condor

Moderately // 86 views

Condor Multiple Vulnerabilities

Less // 164 views

Adobe Flash Player "Clickjacking" Security Bypass Vulnerability

Moderately // 105 views

Gentoo update for wordnet

Moderately // 123 views

Red Hat update for kernel

7th Oct, 2008

New advisories:	19
New vulnerabilities:	68
Updated advisories:	61

Moderately // 476 views

Debian update for php5

Moderately // 372 views

Atarone CMS Multiple Vulnerabilities

Solutions | More...

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.