PT-2014-3700 · Novell · Novell Groupwise

Publicado 2014-08-26 · Atualizado 2017-01-07 · CVE-2014-0600

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Novell GroupWise versions prior to 2014 SP1

Description The issue allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter in the FileUploadServlet of the Administration service. This could potentially lead to information disclosure.

Recommendations For versions prior to 2014 SP1, update to Novell GroupWise 2014 SP1 or later to resolve the issue. As a temporary workaround, consider restricting access to the FileUploadServlet in the Administration service to minimize the risk of exploitation. Avoid using the poLibMaintenanceFileSave parameter in the affected API endpoint until the issue is resolved.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-0600

ZDI-14-296

Produtos afetados

Novell Groupwise

Referências · 7

• http://novell.com/support/kb/doc.php?id=7015566 · Aviso do Fabricante
• http://securitytracker.com/id/1030801 · Nota
• https://bugzilla.novell.com/show_bug.cgi?id=879192 · Nota
• https://zerodayinitiative.com/advisories/ZDI-14-296 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-14-296 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0600 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0600 · Nota de Segurança