Novell GroupWise WebAccess using Apache Web server allows viewing of files on the server
| groupwise-obtain-information (15467) |  Medium Risk |
Description:
Novell GroupWise could allow a remote attacker to obtain sensitive information. If the default configuration is enabled for GroupWise WebAccess on NetWare with Apache Web Server, a remote attacker could obtain sensitive information. If Apache is loaded using the GWAPACHE.CONF file, a remote attacker can exploit this vulnerability to gain unauthorized access to the directories and files on the server.
Platforms Affected:
- Apache, HTTP Server 1.3.3
- Apache, HTTP Server 1.3.30
- Apache, HTTP Server 1.3.31
- Apache, HTTP Server 1.3.32
- Apache, HTTP Server 1.3.33
- Apache, HTTP Server 1.3.34
- Apache, HTTP Server 1.3.35
- Apache, HTTP Server 1.3.36
- Apache, HTTP Server 1.3.37
- Apache, HTTP Server 1.3.38
- Apache, HTTP Server 1.3.39
- Apache, HTTP Server 1.3.4
- Apache, HTTP Server 1.3.5
- Apache, HTTP Server 1.3.6
- Apache, HTTP Server 1.3.7
- Apache, HTTP Server 1.3.8
- Apache, HTTP Server 1.3.9
- Novell, GroupWise 6.0
- Novell, GroupWise 6.5
- Novell, GroupWise WebAccess 6.0
- Novell, GroupWise WebAccess 6.5
- Novell, NetWare 6
Remedy:
Apply Field Test File FWA652E.EXE or later, as listed in Novell Technical Information Document 10091330. See References.
Consequences:
Obtain Information
References:
- Novell Technical Information Document TID10091330, Potential security issue with GroupWise WebAccess 6.0 and 6.5 at http://support.novell.com/cgi-bin/search/searchtid.cgi?/10091330.htm.
- BID-9864: Novell GroupWise WebAccess Unauthorized Access Vulnerability
- CVE-2004-2336: Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where Apache is loaded using GWAPACHE.CONF, allows remote attackers to read directories and files on the server.
- SA11119: Novell Groupwise WebAccess Insecure Default Configuration
- SECTRACK ID: 1009417: GroupWise WebAccess With Apache on NetWare Has Configuration Flaw That May Grant Web Access to Remote Users
Reported:
Mar 13, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net