The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Lotus Domino Buffer Overflow (Time/Date Field)
------------------------------------------------------------------------
SUMMARY
" <http://www.lotus.com/products/product4.nsf/wdocs/dominohomepage> IBM
Lotus Domino server software combines enterprise-class messaging and
calendar/ scheduling capabilities with a robust platform for collaborative
applications on a wide variety of operating systems."
A buffer overflow vulnerability in Lotus Domino allows remote attackers to
execute arbitrary code on the server.
DETAILS
Vulnerable Systems:
* Lotus Domino version 6.5.4
* Lotus Domino version 6.0.5
A buffer overflow vulnerability occurs whenever a user submits large
amount of data to certain time/date fields that can be updated from the
web interface. This vulnerability can be exploited by a malicious user
with access to the web server to cause the Lotus Domino server to execute
arbitrary code and to crash, resulting in a Denial of Server
Vendor Status:
The vendor has issued a patch for both versions:
<http://www-1.ibm.com/support/docview.wss?rs=899&uid=swg21201845>
http://www-1.ibm.com/support/docview.wss?rs=899&uid=swg21201845
ADDITIONAL INFORMATION
The information has been provided by <mailto:mark@ngssoftware.com> NGS
Software.
The vendor advisory can be found at:
<http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21202431>
http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21202431
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
