Secunia

Francisco Amato has reported a vulnerability in Novell GroupWise Client, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in the HTML viewing component when processing e-mail messages. This can be exploited to cause a stack-based buffer overflow via a specially-crafted email message containing an overly-long SRC parameter in the IMG tag.

Successful exploitation requires that the HTML preview option is enabled and that the target user replies to or forwards the malicious email.

The vulnerability affects GroupWise 6.5 SP6 Windows client.

Solution
Apply 6.5.6 Update 2.
Further details available in Customer Area

Provided and/or discovered by
Francisco Amato, Infobyte Security Research

Changelog
Further details available in Customer Area

Original Advisory
Novell:
http://download.novell.com/Download?buildid=VH6T0VgdwWw~

Infobyte Security Research:
http://www.infobyte.com.ar/adv/ISR-16.html

Deep Links
Links available in Customer Area