IBM Lotus Notes File Attachment Handling Multiple Remote Vulnerabilities
BID:16576
Info
IBM Lotus Notes File Attachment Handling Multiple Remote Vulnerabilities
| Bugtraq ID: | 16576 |
| Class: | Unknown |
| CVE: |
CVE-2005-2618 CVE-2005-2619 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 10 2006 12:00AM |
| Updated: | Jun 27 2007 09:08PM |
| Credit: | Discovered by Tan Chew Keong and Carsten Eiram. |
| Vulnerable: |
IBM Lotus Notes 6.5.4 IBM Lotus Notes 6.5.3 IBM Lotus Notes 6.5.2 IBM Lotus Notes 6.5.1 IBM Lotus Notes 6.5 IBM Lotus Notes 6.0.5 IBM Lotus Notes 6.0.4 IBM Lotus Notes 6.0.3 IBM Lotus Notes 6.0.2 IBM Lotus Notes 6.0.1 IBM Lotus Notes 7.0 |
| Not Vulnerable: |
IBM Lotus Notes 7.0.1 IBM Lotus Notes 6.5.5 |
Discussion
IBM Lotus Notes File Attachment Handling Multiple Remote Vulnerabilities
IBM Lotus Notes is prone to multiple remote vulnerabilities. The buffer-overflow issues could allow arbitrary code execution in the context of the user running the application.
The issues are:
- A buffer overflow exists when extracting files from ZIP archives.
- A buffer overflow exists when extracting files from UUE encoded files.
- A buffer overflow exists when extracting files from TAR archives.
- A buffer overflow exists when handling HTML file attachments with malicious links.
- A directory traversal exists when generating previews of ZIP, UUE, and TAR archives. This could be exploited to overwrite arbitrary files in the context of the current user.
Lotus Notes 6.5.4 and 7.0 are prone to these issues. Other versions may also be vulnerable.
IBM Lotus Notes is prone to multiple remote vulnerabilities. The buffer-overflow issues could allow arbitrary code execution in the context of the user running the application.
The issues are:
- A buffer overflow exists when extracting files from ZIP archives.
- A buffer overflow exists when extracting files from UUE encoded files.
- A buffer overflow exists when extracting files from TAR archives.
- A buffer overflow exists when handling HTML file attachments with malicious links.
- A directory traversal exists when generating previews of ZIP, UUE, and TAR archives. This could be exploited to overwrite arbitrary files in the context of the current user.
Lotus Notes 6.5.4 and 7.0 are prone to these issues. Other versions may also be vulnerable.
Exploit / POC
IBM Lotus Notes File Attachment Handling Multiple Remote Vulnerabilities
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution / Fix
IBM Lotus Notes File Attachment Handling Multiple Remote Vulnerabilities
Solution:
These issues have been addressed in Lotus Notes versions 6.5.5 and 7.0.1. Please contact the vendor to obtain fixes.
Solution:
These issues have been addressed in Lotus Notes versions 6.5.5 and 7.0.1. Please contact the vendor to obtain fixes.
References
IBM Lotus Notes File Attachment Handling Multiple Remote Vulnerabilities
References:
References:
- Lotus Homepage (IBM)
- Potential Buffer Overflow and Directory Traversal Vulnerabilities in Lotus Notes (IBM)
- Secunia Research: Lotus Notes HTML Speed Reader Link Buffer Overflows (Secunia Research
- Secunia Research: Lotus Notes Multiple Archive Handling Directory Traversal (Secunia Research
- Secunia Research: Lotus Notes TAR Reader File Extraction Buffer Overflow (Secunia Research
- Secunia Research: Lotus Notes UUE File Handling Buffer Overflow (Secunia Research
- Secunia Research: Lotus Notes ZIP File Handling Buffer Overflow (Secunia Research