IBM Lotus Domino Web Access ActiveX Control Memory Corruption Vulnerabilities

Bugtraq ID:	26972
Class:	Boundary Condition Error
CVE:	CVE-2007-4474
Remote:	Yes
Local:	No
Published:	Dec 20 2007 12:00AM
Updated:	Jan 21 2009 12:52AM
Credit:	Elazar Broad is credited with the discovery of this vulnerability.
Vulnerable:	IBM Lotus Domino Web Access Upload Module 7.0.34.1 IBM Lotus Domino Web Access 7.0.1 IBM Domino Web Access 7.0.1 IBM Domino Web Access 6.5.5 IBM Domino Web Access 6.5.5 IBM Domino Web Access 6.5.4 IBM Domino Web Access 6.5.3 IBM Domino Web Access 6.5.2 IBM Domino Web Access 6.5.1 IBM Domino Web Access 6.0.5 IBM Domino Web Access 6.0.4 IBM Domino Web Access 6.0.3 IBM Domino Web Access 6.0.2 .2 IBM Domino Web Access 6.0.2 .1 IBM Domino Web Access 6.0.1 .3 IBM Domino Web Access 6.0.1 .2 IBM Domino Web Access 6.0.1 .1 IBM Domino Web Access 6.0.1 IBM Domino Web Access 8.0 IBM Domino Web Access 7.0 IBM Domino Web Access 6.5 IBM Domino Web Access 6.0
Not Vulnerable:	IBM Domino Web Access 8.0.1 IBM Domino Web Access 7.0.4 IBM Domino Web Access 6.5.6

IBM Lotus Domino Web Access ActiveX Control Memory Corruption Vulnerabilities

IBM Lotus Domino Web Access ActiveX control is prone to multiple memory-corruption vulnerabilities because the application fails to properly bounds-check user-supplied input.

Successfully exploiting these issues can allow remote attackers to execute arbitrary code in the context of the application using the affected ActiveX control. Failed exploit attempts will likely result in denial-of-service conditions.

IBM Lotus Domino Web Access ActiveX Control Memory Corruption Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to view a malicious HTML page.

The following exploits are available:

• /data/vulnerabilities/exploits/26972.html
• /data/vulnerabilities/exploits/26972-1.html
• /data/vulnerabilities/exploits/26972-2.html
• /data/vulnerabilities/exploits/26972-3.html

IBM Lotus Domino Web Access ActiveX Control Memory Corruption Vulnerabilities

Solution:
The vendor has released updates. Please see the references for more information.

IBM Lotus Domino Web Access ActiveX Control Memory Corruption Vulnerabilities

References:

• [Full-disclosure] IBM Domino Web Access Upload Control dwa7w.dll Memory Corrupti (Elazar Broad ([email protected]))
  
• IBM Lotus Domino Homepage (IBM)
  
• IBM Lotus Domino Web Access Homepage (IBM)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• ActiveX Control Buffer Overflow in Lotus Domino Web Access (iNotes) (IBM)
  
• Vulnerability Note VU#963889 IBM Lotus Domino Web Access ActiveX control stack b (US-CERT)