Some vulnerabilities have been reported in Novell GroupWise Messenger, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerabilities are caused due to boundary errors in the Novell GroupWise Messenger Client when processing certain server responses. These can be exploited to cause stack-based buffer overflows via specially crafted, overly long server responses.

Successful exploitation allows execution of arbitrary code.

NOTE: A client crash when processing a long user ID has also been reported.

The vulnerabilities affect all Novell GroupWise Messenger Client for Windows versions prior to 2.0.3 Hot Patch 1.

Solution
Update to version 2.0.3 Hot Patch 1.
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Francisco Amato of Infobyte Security Research.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Novell:
http://www.novell.com/support/viewContent.do?externalId=7000676&sliceId=1
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5026700.html

Infobyte Security Research:
http://www.infobyte.com.ar/adv/ISR-17.html

Deep Links
Links available to Secunia VIM customers