SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Generic)  >   GroupWise Vendors:   Novell
Novell GroupWise iCalendar Parsing Flaw Lets Remote Users Deny Service
SecurityTracker Alert ID:  1027540
SecurityTracker URL:  http://securitytracker.com/id/1027540
CVE Reference:   CVE-2011-3827   (Links to External Site)
Date:  Sep 18 2012
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 8.0x - 8.02HP3
Description:   A vulnerability was reported in Novell GroupWise. A remote user can cause denial of service conditions.

A remote user can send a specially crafted iCalendar ('.ics') file to cause the target GroupWise Internet Agent (GWIA) to crash. A specially crafted date-time value can trigger this flaw.

The vendor was notified on October 20, 2011.

Carsten Eiram, Secunia Research, reported this vulnerability.

Impact:   A remote user can cause the target GroupWise Internet Agent to crash.
Solution:   The vendor has issued a fix (8.0 SP3).

The vendor's advisory is available at:

http://www.novell.com/support/kb/doc.php?id=7010767

Vendor URL:  www.novell.com/support/kb/doc.php?id=7010767 (Links to External Site)
Cause:   Access control error
Underlying OS:  

Message History:   None.


 Source Message Contents

Date:  Mon, 17 Sep 2012 14:32:46 +0200
Subject:  Secunia Research: Novell GroupWise iCalendar Date/Time Parsing Denial of Service

====================================================================== 

                     Secunia Research 17/09/2012

  - Novell GroupWise iCalendar Date/Time Parsing Denial of Service -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

====================================================================== 
1) Affected Software 

* Novell GroupWise 8.0.2 HP3

NOTE: Other versions may also be affected.

====================================================================== 
2) Severity 

Rating: Moderately critical
Impact: Denial of Service
Where:  Remote

====================================================================== 
3) Vendor's Description of Software 

"Novell GroupWise 8 gives you a wide range of collaborative tools to 
create a truly plugged in work environment.".

Product Link:
http://www.novell.com/products/groupwise/

====================================================================== 
4) Description of Vulnerability

Secunia Research has discovered a vulnerability in Novell GroupWise, 
which can be exploited by malicious people to cause a DoS (Denial of 
Service).

Novell GroupWise includes the GroupWise Internet Agent (GWIA), which 
is responsible for exchanging e-mail messages between GroupWise and 
the Internet via e.g. IMAP4, POP3, and SMTP. The GroupWise Internet 
Agent also supports parsing of iCalendar data, which is implemented 
in gwwww1.dll.

The iCalendar format is used to exchange calendar information and is 
comprised of various groupings of component properties. Some of these 
properties may include date-time information, which can e.g. be 
specified via the TZID parameter of a DTSTART property in a VTIMEZONE 
component. Date-Time information is formatted as: "[date]T[time]" 
where "[date]" is 8 characters and "[time]" is 6 characters (e.g. 
"20120915T230000" means September 15th, 2012 at 11 PM).

NgwiCalTimeProperty::datetime() in gwwww1.dll is responsible for 
parsing date-time information. When called, the function in turn calls
NgwiCalTimeProperty::date() to parse the date in the date-time string.
Upon exiting, NgwiCalTimeProperty::date() returns a pointer to offset 
8 into the date-time string (i.e. where the 'T' and following time 
information is expected to be). This returned pointer is then 
dereferenced in order to evaluate whether the referenced character is 
'T' and parse the expected time information. 

However, no checks are performed by the function to ensure that the 
supplied date-time string is longer than 8 characters. This may result
in an out-of-bounds read access violation, causing GWIA to crash in 
case a shorter date-time string was supplied via e.g. an e-mail with 
a specially crafted .ics attachment.

====================================================================== 
5) Solution 

Update to version 8.0 Support Pack 3 or later.

====================================================================== 
6) Time Table 

20/10/2011 - Vendor notified.
20/10/2011 - Vendor response.
21/12/2011 - Vendor asks for additional information.
21/12/2011 - Clarification provided to the vendor.
21/12/2011 - Vendor response.
08/03/2012 - Vendor provides status update.
18/05/2012 - Vendor provides status update.
29/06/2012 - Status update requested.
29/06/2012 - Vendor provides status update.
06/08/2012 - Vendor provides status update.
13/09/2012 - Vendor provides status update.
14/09/2012 - Vendor provides status update.
17/09/2012 - Public disclosure.

====================================================================== 
7) Credits 

Discovered by Carsten Eiram, Secunia Research.

====================================================================== 
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned 
CVE-2011-3827 for the vulnerability.

Novell:
http://www.novell.com/support/kb/doc.php?id=7010767

====================================================================== 
9) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://secunia.com/advisories/business_solutions/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private 
individuals, who are interested in or concerned about IT-security.

http://secunia.com/advisories/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the 
security and reliability of software in general:

http://secunia.com/secunia_research/

Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:

http://secunia.com/corporate/jobs/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/advisories/mailing_lists/

====================================================================== 
10) Verification 

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2012-30/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC