Lotus Domino Server ESMTP Buffer Overflow Vulnerability

Bugtraq ID:	1229
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	May 18 2000 12:00AM
Updated:	May 18 2000 12:00AM
Credit:	Posted to Bugtraq on May 18, 2000 by Michal Zalewski <[email protected]>. Additional information provided by VIGILANTe <[email protected]> on Sep 11, 2000.
Vulnerable:	Lotus Domino Mail Server 5.0.3 - HP HP-UX 11.0 4 - IBM AIX 4.3.2 - Linux kernel 2.2 .x - Microsoft Windows NT 4.0 - Sun Solaris 7.0 Lotus Domino Mail Server 5.0.2 - HP HP-UX 11.0 4 - IBM AIX 4.3.2 - Linux kernel 2.2 .x - Microsoft Windows NT 4.0 - Sun Solaris 7.0 Lotus Domino Mail Server 5.0.1 - HP HP-UX 11.0 4 - IBM AIX 4.3.2 - Linux kernel 2.2 .x - Microsoft Windows NT 4.0 - Sun Solaris 7.0 Lotus Domino Enterprise Server 5.0.3 - HP HP-UX 11.0 4 - IBM AIX 4.3.2 - Linux kernel 2.2 .x - Microsoft Windows NT 4.0 - Sun Solaris 7.0 Lotus Domino Enterprise Server 5.0.2 - HP HP-UX 11.0 4 - IBM AIX 4.3.2 - Linux kernel 2.2 .x - Microsoft Windows NT 4.0 - Sun Solaris 7.0 Lotus Domino Enterprise Server 5.0.1 - HP HP-UX 11.0 4 - IBM AIX 4.3.2 - Linux kernel 2.2 .x - Microsoft Windows NT 4.0 - Sun Solaris 7.0
Not Vulnerable:

Lotus Domino Server ESMTP Buffer Overflow Vulnerability

The code that handles the 'rcpt to' 'saml from' and 'soml from' commands in the ESMTP service of Lotus Domino Server has an unchecked buffer. If Lotus Domino Server receives an argument of more than 4 KB to the any of the listed commands, the system will crash and will require a reboot in order to regain normal functionality.

Lotus Domino Server ESMTP Buffer Overflow Vulnerability

SMILER <[email protected]> has released the following exploit:

• /data/vulnerabilities/exploits/smtpkill.pl

Lotus Domino Server ESMTP Buffer Overflow Vulnerability

Solution:
Upgrade to Lotus Domino Version 5.0.5

Lotus Domino Server ESMTP Buffer Overflow Vulnerability

References:

• Lotus Domino R5 Mail Server (Lotus)