Multiple vulnerabilities have been reported in Novell GroupWise, which can be exploited by malicious users to disclose potentially sensitive information and by malicious people to conduct cross-site scripting attacks.

1) An unspecified error in the WebAccess component can be exploited to disclose authentication information.

2) Certain input passed to the WebAccess component via HTML messages when replying to a message is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) Certain input is not properly sanitised in the WebAccess component before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Solution
Update to GroupWise 8 Support Pack 2 or later.

Provided and/or discovered by
1) The vendor credits Kevin Lynn, The George Washington University.
2) scriptjunkie via ZDI.
3) The vendor credits Pat Bergoch, Amerimark.

Changelog
Further details available in Customer Area

Original Advisory
Novell:
http://www.novell.com/support/viewContent.do?externalId=7006373
http://www.novell.com/support/viewContent.do?externalId=7006376
http://www.novell.com/support/viewContent.do?externalId=7006379

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-135/

Deep Links
Links available in Customer Area