exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Novell GroupWise iCalendar Date/Time Parsing Denial of Service

Novell GroupWise iCalendar Date/Time Parsing Denial of Service
Posted Sep 17, 2012
Authored by Carsten Eiram | Site secunia.com

Secunia Research has discovered a vulnerability in Novell GroupWise, which can be exploited by malicious people to cause a DoS (Denial of Service). However, no checks are performed by a function in iCalendar to ensure that the supplied date-time string is longer than 8 characters. This may result in an out-of-bounds read access violation, causing GWIA to crash in case a shorter date-time string was supplied via e.g. an e-mail with a specially crafted .ics attachment. Novell GroupWise version 8.0.2 HP3 is affected.

tags | advisory, denial of service
advisories | CVE-2011-3827
SHA-256 | 47079011e77d4b03dcf622040e29f04c46c08e437a5ae7d2a92d9802266de359

Novell GroupWise iCalendar Date/Time Parsing Denial of Service

Change Mirror Download
====================================================================== 

Secunia Research 17/09/2012

- Novell GroupWise iCalendar Date/Time Parsing Denial of Service -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

======================================================================
1) Affected Software

* Novell GroupWise 8.0.2 HP3

NOTE: Other versions may also be affected.

======================================================================
2) Severity

Rating: Moderately critical
Impact: Denial of Service
Where: Remote

======================================================================
3) Vendor's Description of Software

"Novell GroupWise 8 gives you a wide range of collaborative tools to
create a truly plugged in work environment.".

Product Link:
http://www.novell.com/products/groupwise/

======================================================================
4) Description of Vulnerability

Secunia Research has discovered a vulnerability in Novell GroupWise,
which can be exploited by malicious people to cause a DoS (Denial of
Service).

Novell GroupWise includes the GroupWise Internet Agent (GWIA), which
is responsible for exchanging e-mail messages between GroupWise and
the Internet via e.g. IMAP4, POP3, and SMTP. The GroupWise Internet
Agent also supports parsing of iCalendar data, which is implemented
in gwwww1.dll.

The iCalendar format is used to exchange calendar information and is
comprised of various groupings of component properties. Some of these
properties may include date-time information, which can e.g. be
specified via the TZID parameter of a DTSTART property in a VTIMEZONE
component. Date-Time information is formatted as: "[date]T[time]"
where "[date]" is 8 characters and "[time]" is 6 characters (e.g.
"20120915T230000" means September 15th, 2012 at 11 PM).

NgwiCalTimeProperty::datetime() in gwwww1.dll is responsible for
parsing date-time information. When called, the function in turn calls
NgwiCalTimeProperty::date() to parse the date in the date-time string.
Upon exiting, NgwiCalTimeProperty::date() returns a pointer to offset
8 into the date-time string (i.e. where the 'T' and following time
information is expected to be). This returned pointer is then
dereferenced in order to evaluate whether the referenced character is
'T' and parse the expected time information.

However, no checks are performed by the function to ensure that the
supplied date-time string is longer than 8 characters. This may result
in an out-of-bounds read access violation, causing GWIA to crash in
case a shorter date-time string was supplied via e.g. an e-mail with
a specially crafted .ics attachment.

======================================================================
5) Solution

Update to version 8.0 Support Pack 3 or later.

======================================================================
6) Time Table

20/10/2011 - Vendor notified.
20/10/2011 - Vendor response.
21/12/2011 - Vendor asks for additional information.
21/12/2011 - Clarification provided to the vendor.
21/12/2011 - Vendor response.
08/03/2012 - Vendor provides status update.
18/05/2012 - Vendor provides status update.
29/06/2012 - Status update requested.
29/06/2012 - Vendor provides status update.
06/08/2012 - Vendor provides status update.
13/09/2012 - Vendor provides status update.
14/09/2012 - Vendor provides status update.
17/09/2012 - Public disclosure.

======================================================================
7) Credits

Discovered by Carsten Eiram, Secunia Research.

======================================================================
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2011-3827 for the vulnerability.

Novell:
http://www.novell.com/support/kb/doc.php?id=7010767

======================================================================
9) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://secunia.com/advisories/business_solutions/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.

http://secunia.com/advisories/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:

http://secunia.com/secunia_research/

Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:

http://secunia.com/corporate/jobs/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/advisories/mailing_lists/

======================================================================
10) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2012-30/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close