CVE-2008-2703: Novell GroupWise Messenger Client stack buffer overflow via spoofed server responses

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw is remotely exploitable without authentication and yields complete code execution, but it is an older client-side issue with a vendor patch available and no confirmed in-the-wild exploitation in the supplied data.

What it is

The Novell GroupWise Messenger (GWIM) Client before 2.0.3 HP1 for Windows contains multiple stack-based buffer overflows. A remote attacker can trigger them by sending spoofed server responses containing an overly long string after the NM_A_SZ_TRANSACTION_ID field name. Successful exploitation allows arbitrary code execution on the client.

Impact

An attacker can execute arbitrary code in the context of the GWIM client process, giving full control of the affected workstation. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.

Attack surface

Reachable over the network (AV:N) with no authentication required (Au:N) and low attack complexity (AC:L). The flaw is triggered by spoofed server responses, so the attacker must be positioned to deliver responses to the client, and no user interaction beyond normal client operation is indicated.

Exploitation

The record is not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.61121 probability, 0.99118 percentile), and references include vendor advisories and a patch, but no public exploit code is cited in the supplied data.

What to do

• Upgrade the GroupWise Messenger Client to 2.0.3 HP1 or later using the Novell patch referenced in the advisory.
• Restrict client network exposure so only trusted GroupWise Messenger servers can send responses to clients.
• Segment or firewall client networks to limit spoofed server response traffic reaching GWIM clients.
• Monitor vendor advisories for any further updates to the affected client.

Detection

• Monitor GWIM client processes for crashes or abnormal termination consistent with buffer overflow attempts.
• Inspect network traffic for spoofed or unexpected server responses containing oversized NM_A_SZ_TRANSACTION_ID fields.
• Correlate client-side crash reports with network events involving GroupWise Messenger server addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.