‘Novell GroupWise Internet Agent Content-Type Parsing Integer Signedness Code Execution Vulnerability’

Summary

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell GroupWise.’

Credit:

‘The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-10-241/


Details

Vulnerable Systems:
 * Novell Groupwise

Authentication is not required to exploit this vulnerability.

The specific flaw exists within the gwia.exe module responsible for parsing e-mail messages received by the server. When the code encounters a Content-Type header it proceeds to parse out the numbers within its contents. The process does not properly check for signed integers and if it encounters one, it loops excessively while writing to the stack. This can be abused by a remote attacker to execute arbitrary code under the context of the SYSTEM user.

Patch Availability:
Novell States:
Linux – http://download.novell.com/Download?buildid=04oMMaiI9nI~
NetWare/Windows – http://download.novell.com/Download?buildid=aq06Eoy7rf4~

Disclosure Timeline:
2010-09-24 – Vulnerability reported to vendor
2010-11-08 – Coordinated public release of advisory’

Categories: News