Lotus Domino LDAP Denial of Service Vulnerability

Bugtraq ID:	16523
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2005-2712 CVE-2006-0580
Remote:	Yes
Local:	No
Published:	Feb 07 2006 12:00AM
Updated:	Jun 27 2007 09:08PM
Credit:	Discovered by Evgeny Legerov.
Vulnerable:	IBM Lotus Domino 7.0 IBM Lotus Domino 6.5.4 FP 1 IBM Lotus Domino 6.5.4 IBM Lotus Domino 6.5.3 IBM Lotus Domino 6.5.2 IBM Lotus Domino 6.5.1 IBM Lotus Domino 6.5 .0 IBM Lotus Domino 6.0.5 IBM Lotus Domino 6.0.4 IBM Lotus Domino 6.0.4 IBM Lotus Domino 6.0.3 IBM Lotus Domino 6.0.2 CF2 IBM Lotus Domino 6.0.2 IBM Lotus Domino 6.0.1 IBM Lotus Domino 6.0 IBM Lotus Domino 5.0.13
Not Vulnerable:	IBM Lotus Domino 7.0.1 IBM Lotus Domino 6.5.5 IBM Lotus Domino 6.5.4 FP 2

Lotus Domino LDAP Denial of Service Vulnerability

Lotus Domino LDAP server is prone to a denial-of-service vulnerability when handling malformed requests.

Lotus Domino version 7.0 is vulnerable; earlier versions may also be affected.

Lotus Domino LDAP Denial of Service Vulnerability


The following data will cause the server to fail:
30 0c 02 01 01 60 07 02 00 03 04 00 80 00

Lotus Domino LDAP Denial of Service Vulnerability

Solution:
The vendor has released updates to address this issue. Please see the referenced vendor advisory for further information.

Lotus Domino LDAP Denial of Service Vulnerability

References:

• [Dailydave] ProtoVer vs Lotus Domino Server 7.0 (Evgeny Legerov)
  
• IBM Lotus Domino Server LDAP DoS Vulnerability (iDEFENSE)
  
• Lotus Domino Product Homepage (IBM)
  
• Notes/Domino Downloads (IBM)
  
• Potential Denial of Service Vulnerability in Domino LDAP Server Task (IBM)