-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2012.0098
          A security vulnerability has been identified in Novell
               GroupWise 8 and Novell GroupWise 8 WebAccess
                                2 July 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Novell GroupWise 8
                      Novell GroupWise 8 WebAccess
Operating System:     Windows
                      SUSE
                      Netware
Impact/Access:        Access Confidential Data -- Remote/Unauthenticated
Resolution:           Patch/Upgrade
CVE Names:            CVE-2012-0410  
Member content until: Wednesday, August  1 2012

OVERVIEW

        A security vulnerability has been identified in Novell GroupWise 8 and
        Novell GroupWise 8 WebAccess. [1]


IMPACT

        The vendor has provided the following description regarding this
        vulnerability:
        
        "GroupWise WebAccess is vulnerable to a directory traversal exploit in 
        the "User.interface" parameter whereby an attacker could potentially 
        force WebAccess to return the contents of other files under the 
        WebAccess directory structure.
        
        This vulnerability was discovered and reported by Tim Brown with 
        Portcullis Computer Security, LTD. 
        (http://www.portcullis-security.com/)
        
        Novell bug 712163, CVE-2012-0410" [1]


MITIGATION

        The vendor recommends applying the latest Support Pack to correct
        this issue, and has stated that GroupWise 2012 is not affected by this
        issue. [1]


REFERENCES

        [1] Security Vulnerability - GroupWise WebAccess Directory Traversal
            Vulnerability in 'User.interface' parameter
            http://www.novell.com/support/kb/doc.php?id=7000708

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBT/ERIe4yVqjM2NGpAQI3JhAAntZ3rHRUnSr153s7kN+RF18YPRkgpqvM
A0dIyhDrJwQbeoV7sSgu4hySgFUICzMQtjfMXYtYHL29KiAse3PWqyDd4Ff42Zi7
2bRtAk5wAGJt/14nLJkfYE+IKrnEv8rR7JLf2TAvnHrUaRfCZPiHczyiRmRuknO8
iIkJa3FHpm+GNB/E4NZC9f8uYRBbUpO29v1UGhe+vU5seVZQ5LIeHiX5I50OZRpo
w3f1DHaLJQTAvlw6X7MEem+abpC44Ie1JbTk10uitehJEAej7AqIfmoRhb2JXdyx
8J3QJf9BbD5sANmi308t2nszN4IYD6/LTtNuh7BO3a6l59EOCn82vODov773N6DS
LwdV/GuMymaHM7Dd68RYsi8KZMhcoER1AKcPMoHVx/jR0IETy0RS1A6UR/9mmHh3
yk1b2f/ntVnhY1B7eKRbvpRwkjgG8vXbHOo4Tr5N1u2Sq9b7cxFqKCbzcAIjmNSw
Oa+DzXrAvquSf4wm5Vnkz7xgMJhlwUbE/hEpBFwanboyay/JQZ0lA+XRg1kBhVYL
N9wgIN3Aovhybx8WdNrf+Fv+oMeQFuRdLHqZWGohTAiy8O36yX5FNnOcD3h3ywfk
StCDAGc/iYJrh2j155/o2ls1gdPyiNfnRHBSXxSUxtZd5Jf/uKz4EvxCkAH+MF28
NT9TU1IeOGs=
=px3W
-----END PGP SIGNATURE-----