PT-2014-3700 · Novell · Novell Groupwise

Published 2014-08-26 · Updated 2017-01-07 · CVE-2014-0600

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Novell GroupWise versions prior to 2014 SP1

Description The issue allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter in the FileUploadServlet of the Administration service. This could potentially lead to information disclosure.

Recommendations For versions prior to 2014 SP1, update to Novell GroupWise 2014 SP1 or later to resolve the issue. As a temporary workaround, consider restricting access to the FileUploadServlet in the Administration service to minimize the risk of exploitation. Avoid using the poLibMaintenanceFileSave parameter in the affected API endpoint until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-0600

ZDI-14-296

Affected Products

Novell Groupwise

References · 7

• http://novell.com/support/kb/doc.php?id=7015566 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-14-296 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-0600 · Security Note
• http://securitytracker.com/id/1030801 · Note
• https://bugzilla.novell.com/show_bug.cgi?id=879192 · Note
• http://zerodayinitiative.com/advisories/ZDI-14-296 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0600 · Note