From: Secunia Security Advisories (sec-advsecunia.com)
Date: Mon Mar 15 2004 - 01:42:00 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
Novell Groupwise WebAccess Insecure Default Configuration

SECUNIA ADVISORY ID:
SA11119

VERIFY ADVISORY:
http://secunia.com/advisories/11119/

CRITICAL:
Moderately critical

IMPACT:
System access

WHERE:
From remote

SOFTWARE:
Novell Groupwise 6.x

DESCRIPTION:
A security issue has been reported in GroupWise 6 and 6.5 WebAccess,
which potentially can be exploited by malicious people to gain
unauthorised access to a vulnerable server.

The problem is that the WebAccess default configuration is insecure
on systems running NetWare and using the Apache 1.3x web server.

Exploitation furthermore requires that Apache has been loaded using
the "GWAPACHE.CONF" file.

SOLUTION:
Install the most recent field-test file for 6.5 SP2 WebAccess
("FWA652E.EXE" or later) or apply vendor workaround.

-- Vendor workaround --

Edit the permissions section of the "GWAPACHE.CONF" file just under
where the DocumentRoot is specified:

By default, that section reads:

# First, we configure the "default" to be a very restrictive set of
# permissions.
#
<Directory "/">
    Options FollowSymLinks
    AllowOverride None
</Directory>

That section should read:

<Directory "/">
    Options FollowSymLinks
    AllowOverride None
    Order deny,allow
    deny from all
</Directory>

PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.

ORIGINAL ADVISORY:
http://support.novell.com/cgi-bin/search/searchtid.cgi?/10091330.htm

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]