Some vulnerabilities have been reported in Novell GroupWise, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting and script insertion attacks, or potentially compromise a vulnerable system.

1) Multiple errors in the session management mechanism can be exploited to potentially gain access to an authenticated user's account.

2) Input passed via style expressions is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when a specially crafted message is viewed.

3) Certain unspecified input is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when a specially crafted message is viewed.

4) Input passed via the "GWAP.version" and "User.Theme" parameters to the login page ("gw/webacc") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

5) An unspecified error in the Novell GroupWise Internet Agent can be exploited to potentially execute arbitrary code via specially crafted SMTP requests.

6) An error in the Novell GroupWise Internet Agent when processing email addresses can be exploited to potentially execute arbitrary code via specially crafted SMTP requests.

The vulnerabilities are reported in versions prior to 7.03 HP3 and 8.0 HP2.

Solution
Apply 7.03 HP3 or 8.0 HP2.

Provided and/or discovered by
The vendor credits:
1, 2) Jim LaValley of LaValley Consulting
3) Gregory DuChemin
4) Scott White, Secure State
5, 6) Nicolas Joly, Vupen

Changelog
Further details available in Customer Area

Original Advisory
Novell:
http://www.novell.com/support/viewContent.do?externalId=7003266
http://www.novell.com/support/viewContent.do?externalId=7003267
http://www.novell.com/support/viewContent.do?externalId=7003268
http://www.novell.com/support/viewContent.do?externalId=7003271
http://www.novell.com/support/viewContent.do?externalId=7003272
http://www.novell.com/support/viewContent.do?externalId=7003273

SecureState:
http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt

Deep Links
Links available in Customer Area