Some vulnerabilities have been reported in Novell GroupWise, which can be exploited by malicious people to conduct cross-site scripting, cross-site request forgery, and script insertion attacks, bypass certain security restrictions, or compromise a vulnerable system.

1) Input passed to the "User.id" and "Library.queryText" parameters in /gw/webacc is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML or script code in a user's browser session in context of an affected site.

2) Certain HTML emails or HTML attachments are not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious email is viewed.

3) A vulnerability is caused due to the application allowing the user to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to e.g. add a forwarding rule or change certain settings e.g. when a user visits a malicious web page.

4) A vulnerability is caused due to an error within the handling of HTTP POST requests. This can be exploited to convert POST requests into GET requests, which can be used to gain access to certain restricted GroupWise information.

5) A vulnerability is caused due to an off-by-one error when processing SMTP RCPT arguments within the Novell GroupWise Internet Agent (GWIA) SMTP daemon. This can be exploited to e.g. crash the vulnerable service or potentially execute arbitrary code via an overly long email address.

The vulnerabilities are reported in GroupWise 6.5x, GroupWise 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and GroupWise 8.0. Other versions may also be affected.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) Richard Brain, ProCheckup Ltd
2, Jan Fry, ProCheckUp Ltd
3, 4) Adrian Pastor, ProCheckUp Ltd
5) Nick DeBaggis, reported via TippingPoint's Zero Day Initiative

Changelog
Further details available in Customer Area

Original Advisory
1) http://www.novell.com/support/viewContent.do?externalId=7002321
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-23

2) http://www.novell.com/support/viewContent.do?externalId=7002320
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-22

3) http://www.novell.com/support/viewContent.do?externalId=7002319
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-21

4) http://www.novell.com/support/viewContent.do?externalId=7002322
5) http://www.novell.com/support/viewContent.do?externalId=7002502
http://www.zerodayinitiative.com/advisories/ZDI-09-010/

Deep Links
Links available in Customer Area