[NEWS] IBM Lotus Domino iNotes Multiple XSS Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  IBM Lotus Domino iNotes Multiple XSS Vulnerabilities
------------------------------------------------------------------------


SUMMARY

" 
<http://www-142.ibm.com/software/sw-lotus/products/product1.nsf/wdocs/webaccesshome>
 IBM Lotus Domino Web Access is the flexible, high-function Web browser-based 
client option to use the reliable, security-rich messaging and collaboration 
capabilities of IBM Lotus Domino server, online and offline".

There are multiple cross site scripting vulnerabilities on IBM Lotus 
Domino iNotes, potentially allowing arbitrary Javascript execution.

DETAILS

Vulnerable Systems:
 * IBM Lotus Domino Web Access 7.x
 * IBM Lotus Domino Web Access (iNotes) 6.x
 * IBM Lotus Domino 6.x
 * IBM Lotus Domino 7.x

Immune Systems:
 * IBM Lotus Domino Web Access 6.5.5
 * IBM Lotus Domino Web Access 7.0.1

Attached files (e.g. ".html" files) are opened in the context of the site 
if the user clicks on it. This can be exploited to execute arbitrary 
JavaScript code in the context of the user's session.

The email subject is not properly sanitized before being displayed to the 
user as the browser title. This can be exploited to execute arbitrary 
JavaScript in the context of the user's session when the user views a 
received email.

Example:
< / TITLE>< SCRIPT>alert("Vulnerable!");< / SCRIPT>

It is possible to bypass certain security checks related to "javascript:" 
URLs by inserting "&#13;" in the middle of the URL.
This can be exploited to execute arbitrary JavaScript code in the context 
of the user's session.

Example:
< a href="java&#13;script:alert('Vulnerable!');">Link< / a>

The attachment filename is not properly sanitized before being displayed 
to the user. This can be exploited to execute arbitrary JavaScript in 
context of the user's session when the user views a received email.

Successful exploitation requires that the Domino Web Access ActiveX 
control is not installed on the browser.

Disclosure Timeline:
22/08/2005 - Initial vendor notification.
25/08/2005 - Initial vendor response.
10/02/2006 - Public disclosure.


ADDITIONAL INFORMATION

The information has been provided by  <mailto:vuln@secunia.com> Secunia 
Research.
The original article can be found at:  
<http://secunia.com/secunia_research/2005-38/> 
http://secunia.com/secunia_research/2005-38/



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.