PT-2009-4120 · Novell · Novell Groupwise

Published 2009-05-26 · Updated 2018-10-10 · CVE-2009-1636

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Novell GroupWise versions 7.x through 7.03 HP2 and versions 8.x through 8.0 HP1

Description: The issue is related to multiple buffer overflows in the Internet Agent component. Remote attackers can execute arbitrary code via a crafted e-mail address in an SMTP session or an SMTP command.

Recommendations: For Novell GroupWise versions 7.x through 7.03 HP2, update to version 7.03 HP3 or later. For Novell GroupWise versions 8.x through 8.0 HP1, update to version 8.0 HP2 or later.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-1636

Affected Products

Novell Groupwise

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2009-1636 · Security Note
• http://novell.com/support/viewContent.do?externalId=7003273&sliceId=1 · Vendor Advisory
• http://secunia.com/advisories/35177 · Vendor Advisory
• http://vupen.com/exploits/Novell_GroupWise_GWIA_SMTP_Command_Remote_Buffer_Overflow_PoC_Exploit_1393140.php · Vendor Advisory
• http://vupen.com/exploits/Novell_GroupWise_GWIA_Email_Address_Remote_Buffer_Overflow_Exploit_1393141.php · Vendor Advisory
• http://vupen.com/english/advisories/2009/1393 · Vendor Advisory
• http://securityfocus.com/bid/35065 · Note
• http://securityfocus.com/archive/1/503724/100/0/threaded · Note
• https://bugzilla.novell.com/show_bug.cgi?id=478892 · Note
• http://securityfocus.com/bid/35064 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50692 · Note
• http://osvdb.org/54644 · Note
• https://bugzilla.novell.com/show_bug.cgi?id=482914 · Note
• http://securitytracker.com/id?1022276 · Note
• http://novell.com/support/viewContent.do?externalId=7003272&sliceId=1 · Note