Novell GroupWise Messenger Server Nmma.EXE Denial of Service Vulnerability

Bugtraq ID:	20316
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2006-4511
Remote:	Yes
Local:	No
Published:	Oct 03 2006 12:00AM
Updated:	Oct 03 2006 09:10PM
Credit:	CIRT.DK is credited with discovering this vulnerability.
Vulnerable:	Novell GroupWise Messenger 2.0 Novell GroupWise Messenger 0
Not Vulnerable:

Novell GroupWise Messenger Server Nmma.EXE Denial of Service Vulnerability

Novell GroupWise Messenger server is prone to a denial-of-service vulnerability that occurs when the application fails to handle a client request with an unexpected parameter.

An attacker may exploit this issue to crash the vulnerable application, denying further service to legitimate users.

Novell GroupWise Messenger Server Nmma.EXE Denial of Service Vulnerability

An attacker may exploit this vulnerability by using standard network utilities.

Novell GroupWise Messenger Server Nmma.EXE Denial of Service Vulnerability

Solution:
Novell has released advisories and fixes to address this issue. Please see the references for more information.


Novell GroupWise Messenger 0

• Novell gwim106hp1.exe
  http://support.novell.com/servlet/filedownload/sec/ftf/gwim106hp1.exe/

Novell GroupWise Messenger 2.0

• Novell gwim202hp1.exe
  http://support.novell.com/servlet/filedownload/sec/ftf/gwim202hp1.exe/

Novell GroupWise Messenger Server Nmma.EXE Denial of Service Vulnerability

References:

• Novell GroupWise Messenger 1.0.6 Agents - TID2974452 (Novell)
  
• Novell GroupWise Messenger 2.02 Agents - TID2974440 (Novell)
  
• Novell Homepage (Novell)
  
• Novell Product Support Homepage (Novell)
  
• iDefense Security Advisory 10.02.06: Novell GroupWise Messenger nmma.exe (iDefense Labs)