Novell GroupWise WebAccess Information Disclosure Vulnerability

Bugtraq ID:	7366
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 16 2003 12:00AM
Updated:	Apr 16 2003 12:00AM
Credit:	This vulnerability was reported by the vendor.
Vulnerable:	Novell Groupwise 6.0 SP2 Novell Groupwise 6.0 SP1 Novell Groupwise 6.0
Not Vulnerable:	Novell Groupwise 6.0 SP3

Novell GroupWise WebAccess Information Disclosure Vulnerability

It has been reported that Novell GroupWise WebAccess may disclose sensitive information to other users in the form URLS contained in the internet history.

This vulnerability has been reported to present itself as an issue when Microsoft Ineternet explorer 5.0 is used to authenticate and retrieve messages stored on the GroupWise server.

Novell GroupWise WebAccess Information Disclosure Vulnerability

There is no exploit required.

Novell GroupWise WebAccess Information Disclosure Vulnerability

Solution:
The vendor has released a service pack to address this issue:


Novell Groupwise 6.0

• Novell gw6sp3m.exe
  http://support.novell.com/servlet/filedownload/pub/gw6sp3m.exe

Novell Groupwise 6.0 SP1

• Novell gw6sp3m.exe
  http://support.novell.com/servlet/filedownload/pub/gw6sp3m.exe

Novell Groupwise 6.0 SP2

• Novell gw6sp3m.exe
  http://support.novell.com/servlet/filedownload/pub/gw6sp3m.exe

Novell GroupWise WebAccess Information Disclosure Vulnerability

References:

• GroupWise 6 Support Pack 3 Multi-lan - TID2965454 (Novell)