Novell GroupWise Client 'gxmim1.dll' ActiveX Control Buffer Overflow Vulnerability

Bugtraq ID:	36398
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 15 2009 12:00AM
Updated:	Sep 15 2009 10:21PM
Credit:	Francis Provencher
Vulnerable:	Novell Groupwise Client 7.0.3.1294
Not Vulnerable:

Novell GroupWise Client 'gxmim1.dll' ActiveX Control Buffer Overflow Vulnerability

Novell GroupWise Client is prone to an unspecified buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successful exploits allow remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions.

Novell GroupWise Client 7.0.3.1294 is vulnerable; other versions may also be affected.

Novell GroupWise Client 'gxmim1.dll' ActiveX Control Buffer Overflow Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/36398.html

Novell GroupWise Client 'gxmim1.dll' ActiveX Control Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Novell GroupWise Client 'gxmim1.dll' ActiveX Control Buffer Overflow Vulnerability

References:

• Novell GroupWise Homepage (Novell)