PRL-2012-04

#####################################################################################

Application:   Novell Groupwise Address Book Remote Code Execution

Platforms:   Windows

Exploitation:   Remote code execution

CVE Number:   2011-4189

Novell TID:   733885

{PRL}:   2012-04

Author:   Francis Provencher (Protek Research Lab’s)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code

#####################################################################################

===============
1) Introduction
===============

Novell, Inc. is a global software and services company based in Waltham, Massachusetts. The company specializes in

enterprise operating systems, such as SUSE Linux Enterprise and Novell NetWare; identity, security, and systems

management solutions; and collaboration solutions, such as Novell Groupwise and Novell Pulse. Novell was instrumental

in making the Utah Valley a focus for technology and software development. Novell technology contributed to the

emergence of local area networks, which displaced the dominant mainframe computing model and changed computing

worldwide. Today, a primary focus of the company is on developing open source software for enterprise clients.

(http://en.wikipedia.org/wiki/Novell)

#####################################################################################

============================
2) Report Timeline
============================

2011-11-30  Vulnerability reported to vendor
2012-02-29  Vendor disclose patch

#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installation of Novell Groupwise Client.

User must open a malformed Novell Address Book (*.NAB) with an overly long email address to trigger this vulnerability.

#####################################################################################

===========
4) The Code
===========

Here

###############################################################################