TippingPoint Zero Day Initiative

Novell GroupWise Internet Agent Content-Type Parsing Integer Signedness Remote Code Execution Vulnerability

ZDI-10-241: November 8th, 2010

CVSS Score

Affected Vendors

Affected Products


TippingPoint™ IPS Customer Protection

TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 10653. For further product information on the TippingPoint IPS:

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell GroupWise. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the gwia.exe module responsible for parsing e-mail messages received by the server. When the code encounters a Content-Type header it proceeds to parse out the numbers within its contents. The process does not properly check for signed integers and if it encounters one, it loops excessively while writing to the stack. This can be abused by a remote attacker to execute arbitrary code under the context of the SYSTEM user.

Vendor Response

Novell states:

Linux - http://download.novell.com/Download?buildid=04oMMaiI9nI~
NetWare/Windows - http://download.novell.com/Download?buildid=aq06Eoy7rf4~

The GroupWise Internet Agent (GWIA) has a vulnerability in the way that it parses numbers within the "Content-Type" header of a received message, which could potentially allow an unauthenticated remote attacker to execute arbitrary code on vulnerable installations of GWIA.
Affected versions: GroupWise 8.0x, 8.01x, 8.02. Previous versions of GroupWise are likely also vulnerable but are no longer supported. Customers on earlier versions of GroupWise should, at a minimum, upgrade their GWIAs and associated Domains to version 8.02HP in order to secure their system.
This vulnerability was discovered and reported by Anonymous working with TippingPoint's Zero Day Initiative (http://www.zerodayinitiative.com), ZDI-CAN-953
Novell bug 642338, CVE number pending
Related TID: http://www.novell.com/support/search.do?usemicrosite=true&searchString=7007154

Disclosure Timeline

    2010-09-24 - Vulnerability reported to vendor
    2010-11-08 - Coordinated public release of advisory


This vulnerability was discovered by: