Multiple vulnerabilities have been reported in Novell GroupWise, which can be exploited by malicious users to compromise a vulnerable system, and by malicious people to conduct cross-site scripting attacks and manipulate certain data.

1) Certain input passed to the Message Transfer Agent, Post Office Agent, Internet Agent, WebAccess Agent, and Monitor Agent is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) An input sanitation error in the HTTP interface for the Message Transfer Agent, Post Office Agent, Internet Agent, WebAccess Agent, and Monitor Agent can be exploited to insert arbitrary HTTP headers via specially crafted web requests.

3) A boundary error in the IMAP functionality of the Internet Agent component can be exploited to cause a stack-based buffer overflow via an overly long mailbox name passed to the "CREATE" verb.

4) Certain input passed to the WebAccess component via HTML messages is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

5) An input sanitation error in the WebAccess component can be exploited to insert arbitrary HTTP headers via specially crafted web requests.

6) An error in the user Proxy feature of the WebAccess component can be exploited to cause a stack-based buffer overflow via an overly long string.

Successful exploitation may allow execution of arbitrary code.

The vulnerabilities are reported in versions 7.0, 7.01, 7.02, 7.03x, 7.04, 8.0, and 8.01x.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
1,2) The vendor credits Kevin Lynn, The George Washington University.
3) Francis Provencher via ZDI.
4) scriptjunkie via ZDI.
5) The vendor credits Ty Bailey, Rapid7.
6) Francis Provencher, Protek Research Labs.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Novell:
http://www.novell.com/support/viewContent.do?externalId=7006371
http://www.novell.com/support/viewContent.do?externalId=7006372
http://www.novell.com/support/viewContent.do?externalId=7006374
http://www.novell.com/support/viewContent.do?externalId=7006375
http://www.novell.com/support/viewContent.do?externalId=7006377
http://www.novell.com/support/viewContent.do?externalId=7006380

PRL:
http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=14&Itemid=14
http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=15&Itemid=15

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-129/
http://www.zerodayinitiative.com/advisories/ZDI-10-135/

Deep Links
Links available to Secunia VIM customers