-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2014.1042
          Novell Messenger 2.2 and OpenSSL security vulnerability
                               26 June 2014

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Novell Messenger
Publisher:         Novell
Operating System:  Linux variants
                   SUSE
                   Windows
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Access Privileged Data          -- Remote/Unauthenticated
                   Denial of Service               -- Remote/Unauthenticated
                   Provide Misleading Information  -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2014-3470 CVE-2014-0224 CVE-2014-0221
                   CVE-2014-0198 CVE-2014-0195 CVE-2014-0076
                   CVE-2010-5298  

Reference:         ESB-2014.0887

Original Bulletin: 
   https://www.novell.com/support/kb/doc.php?id=7015271

- --------------------------BEGIN INCLUDED TEXT--------------------

Novell Messenger 2.2 and OpenSSL security vulnerability

Document ID:7015271

Creation Date:23-JUN-14

Modified Date:23-JUN-14

Novell
       
Messenger

This document (7015271) is provided subject to the disclaimer at the end of 
this document.

Environment

Novell Messenger 2.x

Novell Messenger 2.2.x

Novell Messenger 2.2.2

Situation

There is a known security vulnerability with OpenSSL that is used in previous
versions of Novell Messenger.

See the following information from OpenSSL.org at: 
https://www.openssl.org/news/secadv_20140605.txt.

Resolution

Update both the Novell Messenger server agents and the Novell Messenger 
clients to Novell Messenger 2.2 Support Pack 2 Hot Patch 1 (Novell Messenger 
2.2.2 Hot Patch 1).

Cause

OpenSSL security vulnerabilty.

Status

Security Alert

Additional Information

See: https://www.openssl.org/news/secadv_20140605.txt

Disclaimer

This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE 
customers and parties interested in our products and solutions to acquire 
information, ideas and learn from one another. Materials are provided for 
informational, personal or non-commercial use within your organization and are
presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBU6u0LhLndAQH1ShLAQLzbQ/7BFicejvBuBNvzLhabGhwQHUY1C2eD1fa
lcSbj/uwTKvEeqKEfOmxj+x9yOe2Cx5VoixKZuqXtlYm0h+/32hTUi50LBAZvBWd
rM+sTsADbUUCtoZtI+FusU4BaK1Myv2HSxnKSzeKLw7bB6Uc2P1Td6N8X+rZIb9W
VJ1iZrMRuzhm0SQPo2rMZD3zDVpo9MoSQuQeFMI/YIuorICtZUqJhVLJU9wMhYz4
/vQNqYVaS7y6V/IyhwBbJ20aoyoUbQjD3X9albdScbrYeGYtNGdsdkY5zhbKg7f7
gIvENMkdJZI+wbuy6t/EeDjk9alR2OxR+qg1ngcxcpJ7A6rHGPi4nPSqntZt/YWR
fxyTYXqxLkyQW2P0E7mPr3N3NM8oqQVSx4Ah4+V5luD6kLbrliTpaQFefuy8wnTc
xxxsPunR6n+iBzLFNnWAFxUq6wV6cXhsL5QguUtOSoH8xzZAoFkKtlw+iUvIuxFv
+UgagBBIiNZ/vEUMO9I/ASGBvUNizoYsdsif5Clw8jebB9AyLmWCQmwiOMKqqVFl
dvPYE+R5YJN3x7hnJ2RwvZf+cEZo5u0C0Bp35Au+8ZRNSdtovy0GZsxNSsajdjWe
sOG1tnBJALAe0EXPBRdJdM3uZUYLGm063OtIXPMuxW1JoNJts5e07eo5glL4QLoN
3hcxiuYFl5c=
=ZXDC
-----END PGP SIGNATURE-----