Security tester ProCheckUp has found critical bugs in Novell's GroupWise WebAccess that could allow e-mail theft.
The possible attack on the Web-based groupware stems from cross-site request forgery (CSRF) in which a forged HTTP request configured in the software under the user's authentication can send a new rule to mail forwarding (CVE-2009-0272). The attacker could then forward the user's mail to an account of the attacker's choice. To fall into this trap, the user needs only visit a website, click a link or open HTML mail prepared with the attacker's CSRF. With the new rule in place, the user could face a perpetual security threat.
ProCheckUp will release details of the sample attacker code (or "proof of concept") only after consulting with Novell and having a resolution on hand.
The security hole affects GroupWise versions 6.5x, 7.0, 7.01, 7.02x, 7.03 and 8.0. Novell has issued patches on its support website, at least for version 7.x and later. For end-of-life version 6.5x an upgrade is required to 7.03 or 8.0.
ProCheckUp also found two attack windows for cross-site scripting (XSS) in the above-mentioned GroupWise versions. An attacker can slip scripting code into HTML mail or attachments that could inflict (in the first case) temporary or (in the second case) permanent harm, with possible identity theft (CVE-2009-0273). Novell has also posted two separate hot patches (first and second) for these bugs on their support site.
The Raspberry Pi Foundation has announced an even smaller version of the tiny computer that will fit into a DIMM slot.
A new class of problems lets a malicious app pre-configure an invisible privilege update.
New Hack language adds static typing and other conveniences.
New crypto policy system will offer easier configuration and more uniform security.
Ubuntu founder denounces insecurity in proprietary, close-source software blobs.
Vulnerability affects many Linux web servers
The Bavarian capital shuns Microsoft, Google, and other alternatives to implement an open source groupware solution.
Phone vendor partnerships bring Mark Shuttleworth's dream of Ubuntu on a phone a step closer to reality.
Donors will get to vote on new features for the free video editor.
Debian project puts init out to pasture and says no to Ubuntu's Upstart.