PT-2011-4009 · Novell · Novell Groupwise

Published 2011-10-08 · Updated 2012-05-14 · CVE-2011-2662

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Novell GroupWise version 8.0 before HP3

Description The issue is related to an integer signedness error in the GroupWise Internet Agent (GWIA) component. This error can be exploited by remote attackers to execute arbitrary code. The exploitation occurs through a negative BYWEEKNO property in a weekly RRULE variable within a VCALENDAR attachment in an e-mail message.

Recommendations For Novell GroupWise version 8.0 before HP3, apply the HP3 patch to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2011-2662

Affected Products

Novell Groupwise

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2011-2662 · Security Note
• http://novell.com/support/viewContent.do?externalId=7009215 · Vendor Advisory
• https://bugzilla.novell.com/show_bug.cgi?id=707527 · Note
• https://labs.idefense.com/verisign/intelligence/2009/vulnerabilities/display.php?id=947 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2662 · Note