CIA RESEARCH
Alerts
[CIA-1042-Alert] Lotus Domino Directory Traversal and URL/Archive Processing Buffer Overflows
Summary:
Multiple vulnerabilities in Lotus Domino/Notes allow a remote attacker to craft malicious content to attack Lotus Notes users.
Technical Details:
Several vulnerabilities were discovered in Lotus Domino/Notes 6.5.4 and previous versions and in version 7.0. Affected versions allow a remote user to execute malicious code in multiple ways.
- Buffer overflow in URLs embedded within email messages: A remote attacker can embed an overly long URL within an email message resulting in a stack overflow When a user clicks on the link.
- Multiple Buffer Overflows in file Processing: Buffer overflows were discovered in the processing of ZIP, TAR, and UUE files, allowing a remote attacker to craft a file that will execute arbitary code when the archive is opened or processed by the user.
Solution:
IBM has released patches to eliminate these security issues.
IBM Support
CVE Reference:
CVE-2005-2618
CVE-2005-2619
SecurityTracker Number(s):
1015657
Vendor URL:
IBM
About the Cenzic CIA Team:
Cenzic Intelligent Analysis (CIA) is Cenzic's research arm that focuses on continuous research
for application vulnerabilities. Industry Research, Vulnerability assessment, penetration
testing, and security testing - that's what Cenzic Intelligent Analysis Research is all about.
Cenzic has dedicated experts whose sole job is to perform ongoing research to find not only
common vulnerabilities but also vulnerabilities found in customer applications and make them
available to our customers and to the community at large.
About Cenzic:
Cenzic provides Hailstorm® the revolutionary enterprise software suite for automated application
security assessment and compliance that allows corporations and government organizations to dramatically
improve the security of commercial and custom applications. Hailstorm enables security experts,
QA professionals, and developers to work together to assess, analyze, and remediate applications for
security vulnerabilities, and verify compliance with security policies. Benefits include reduced
security risk and liability, lower development and testing costs, and faster time-to-market.
Cenzic's customers are currently in the financial services and e-marketplaces sectors. For more
information visit www.cenzic.com or call 1-866-4-CENZIC
|
