Novell GroupWise Windows Client API Shared Folder Email Information Disclosure Vulnerability

Bugtraq ID:	28265
Class:	Access Validation Error
CVE:	CVE-2008-1330
Remote:	Yes
Local:	No
Published:	Mar 17 2008 12:00AM
Updated:	Mar 17 2008 06:21PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Novell Groupwise 7.0 Novell Groupwise 6.5.7 Novell Groupwise 6.5.6 Novell Groupwise 6.5.4 Novell Groupwise 6.5.3 Novell Groupwise 6.5.2 Novell Groupwise 6.5 SP6 Update 1 Novell Groupwise 6.5 SP6 Novell Groupwise 6.5 SP5 Novell Groupwise 6.5 SP4 Novell Groupwise 6.5 SP3 Novell Groupwise 6.5 SP2 Novell Groupwise 6.5 SP1 Novell Groupwise 6.5 Novell Groupwise 7.0.0 SP2 Novell Groupwise 7.0.0 SP1
Not Vulnerable:	Novell Groupwise 7.0.0 SP3 Novell Groupwise 6.5 SP6 Update 3

Novell GroupWise Windows Client API Shared Folder Email Information Disclosure Vulnerability

Novell GroupWise Windows Client API is prone to an information-disclosure vulnerability. This issue affects the handling of shared folders.

Successfully exploiting this issue allows remote, authenticated attackers to gain access to non-shared email contained in a targeted user's mailbox. To exploit this issue, attackers must be permitted access to the shared folder of another user.

This issue affects Novell GroupWise 6.5 and 7. Previous versions may also be affected.

Novell GroupWise Windows Client API Shared Folder Email Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Novell GroupWise Windows Client API Shared Folder Email Information Disclosure Vulnerability

Solution:
The vendor has released an advisory along with fixes. Please see the references for more information.

Novell GroupWise Windows Client API Shared Folder Email Information Disclosure Vulnerability

References:

• Novell GroupWise Homepage (Novell)
  
• GroupWise Windows Client API Security Vulnerability report (Novell)