OSVDB ID: 24617

Title: Novell GroupWise Messenging Agent Accept-Language Header Remote Overflow

Info

Disclosure
Apr 13, 2006

Discovery
Mar 16, 2006

Dates

Exploit
Apr 15, 2006

Solution
Apr 13, 2006

Description

 A remote overflow exists in Novell GroupWise Messenger. The Novell Messaging Agent service fails to check length during the parsing of long parameters within the Accept-Language header resulting in a stack-based buffer overflow. With a specially crafted request, an attacker can cause arbitrary code execution in the context of SYSTEM or superuser.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Public, Exploit Private, Exploit Commercial
Disclosure: OSVDB Verified, Vendor Verified

Solution

 Upgrade to GroupWise Messenger version 2.0 Public Beta 2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Novell, Inc.

GroupWise Messenger

 2.0
2.0 Public Beta 2

References

Credit
  • CIRT - advisorycirt.dk - Danish Computer Incident Response Team


Direct URL: http://osvdb.org/24617