[NEWS] GroupWise Windows Client API Security Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



GroupWise Windows Client API Security Vulnerability
------------------------------------------------------------------------


SUMMARY

A security vulnerability exists in the GroupWise Windows client API that
can allow programmatic access to non-authorized email under certain
conditions. The attacker must first authenticate to GroupWise and be a
recipient of a shared folder from another user. The attacker could then
exploit the vulnerability to gain unauthorized access to non-shared email
in the mailbox of the sharer.

DETAILS

Vulnerable Systems:
* Novell GroupWise version 7
* Novell GroupWise version 6.5

Immune Systems:
* Novell GroupWise version 7 SP3
* Novell GroupWise version 6.5 SP6 client Update 3

Workaround:
Users that have shared folders with other users can protect their email by
removing shared access until remedial steps have been completed. It is not
necessary to delete the contents of the shared folders and they can be
re-shared after the administrator has locked out older client versions.

To remove shared access to a folder select the shared folder, click File >
Sharing, then select Not shared

Remedy:
For GroupWise 7 - Customers running GroupWise 7.0 clients should
immediately upgrade all clients to GroupWise 7 SP3 (dated 09 Mar 2008) and
lock out older clients via ConsoleOne.

GroupWise 6.5 Windows- Customers running GroupWise 6.5 Windows clients
should immediately upgrade all Windows clients to the GroupWise 6.5 SP6
client Update 3 (dated 11 Mar 2008), or upgrade to GroupWise 7 SP3. Older
clients must be locked out via ConsoleOne.

GroupWise 6.5 Linux - Customers running GroupWise 6.5 Linux or Mac clients
should immediately upgrade to GroupWise 7 SP3 (dated 09 Mar 2008).

For GroupWise 6.0 and previous - Customers still running unsupported
GroupWise client versions (5.x and 6) should immediately upgrade clients
and servers to either GroupWise 6.5 SP6 Update 3 or to GroupWise 7 SP3.
Older clients must be locked out via ConsoleOne.

If Blackberry Enterprise Server (BES) is installed in a GroupWise 7
environment then upgrade the BES to a version which supports the GroupWise
7 client (BES 4.0 SP 7 or BES 4.1 SP4), and upgrade the GW client
installed on the machine to 7.0 SP3 (dated 09 Mar 2008).

If Blackberry Enterprise Server (BES) is installed in a GroupWise 6.5
environment then upgrade the GW client installed on the machine to 6.5 SP6
Client Update 3 (dated 11 Mar 2008).


ADDITIONAL INFORMATION

The information has been provided by <mailto:secure@xxxxxxxxxx> Novell
Security.
The original article can be found at:
<https://secure-support.novell.com/KanisaPlatform/Publishing/732/3263374_f.SAL_Public.html> https://secure-support.novell.com/KanisaPlatform/Publishing/732/3263374_f.SAL_Public.html



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages