Lotus Domino Webserver DOS Device Extension Denial of Service Vulnerability

Bugtraq ID:	4020
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Feb 04 2002 12:00AM
Updated:	Feb 04 2002 12:00AM
Credit:	This vulnerability was discovered by Peter Gründl <[email protected]>.
Vulnerable:	Lotus Domino 5.0.9 Lotus Domino 5.0.8 Lotus Domino 5.0.7 - HP HP-UX 9.9 - HP HP-UX 9.9 - IBM AIX 4.3 - IBM AIX 4.3 - IBM OS/2 4.5 Warp - IBM OS/2 4.5 Warp - IBM OS/390 V2R9 - IBM OS/390 V2R9 - Linux kernel 2.3 - Linux kernel 2.3 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 8_sparc Lotus Domino 5.0.6 - HP HP-UX 9.9 - HP HP-UX 9.9 - IBM AIX 4.3 - IBM AIX 4.3 - IBM OS/2 4.5 Warp - IBM OS/2 4.5 Warp - IBM OS/390 V2R9 - IBM OS/390 V2R9 - Linux kernel 2.3 - Linux kernel 2.3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 8_sparc Lotus Domino 5.0.5 - HP HP-UX 9.9 - HP HP-UX 9.9 - IBM AIX 4.3 - IBM AIX 4.3 - IBM OS/2 4.5 Warp - IBM OS/2 4.5 Warp - IBM OS/390 V2R9 - IBM OS/390 V2R9 - Linux kernel 2.3 - Linux kernel 2.3 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 8_sparc Lotus Domino 5.0.4 - HP HP-UX 9.9 - HP HP-UX 9.9 - IBM AIX 4.3 - IBM AIX 4.3 - IBM OS/2 4.5 Warp - IBM OS/2 4.5 Warp - IBM OS/390 V2R9 - IBM OS/390 V2R9 - Linux kernel 2.3 - Linux kernel 2.3 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 8_sparc Lotus Domino 5.0.3 - HP HP-UX 9.9 - HP HP-UX 9.9 - IBM AIX 4.3 - IBM AIX 4.3 - IBM OS/2 4.5 Warp - IBM OS/2 4.5 Warp - IBM OS/390 V2R9 - IBM OS/390 V2R9 - Linux kernel 2.3 - Linux kernel 2.3 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 8_sparc Lotus Domino 5.0.2 - HP HP-UX 9.9 - HP HP-UX 9.9 - IBM AIX 4.3 - IBM AIX 4.3 - IBM OS/2 4.5 Warp - IBM OS/2 4.5 Warp - IBM OS/390 V2R9 - IBM OS/390 V2R9 - Linux kernel 2.3 - Linux kernel 2.3 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 8_sparc Lotus Domino 5.0.1 - HP HP-UX 9.9 - HP HP-UX 9.9 - IBM AIX 4.3 - IBM AIX 4.3 - IBM OS/2 4.5 Warp - IBM OS/2 4.5 Warp - IBM OS/390 V2R9 - IBM OS/390 V2R9 - Linux kernel 2.3 - Linux kernel 2.3 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 8_sparc Lotus Domino 5.0 Lotus Domino 4.6.4 - Microsoft Windows NT 4.0 Lotus Domino 4.6.3 Lotus Domino 4.6.1 - Microsoft Windows NT 4.0
Not Vulnerable:	Lotus Domino 5.0.9 a

Lotus Domino Webserver DOS Device Extension Denial of Service Vulnerability

Lotus Domino Server is an application framework for web based
collaborative software. It runs on multiple platforms including Windows
and Unix.

It has been reported that all versions of Lotus Domino Webserver prior to 5.0.9a running on Windows 2000 may be vulnerable to a denial of service condition.

If a request for a DOS device from CGI-BIN has an extension of 220 characters, the server will spawn a cmd.exe session to run nul.pif. The server will also pop up a window asking for a program association to run nul.pif with. If this is done approximately 400 times, the server will reportedly run out of working threads.

This vulnerability may not having anything to do with the inclusion of MS-DOS device names in requests, but this is unconfirmed.

Lotus Domino Webserver DOS Device Extension Denial of Service Vulnerability

There is no exploit code required for this vulnerability.

Lotus Domino Webserver DOS Device Extension Denial of Service Vulnerability

Solution:
The vendor has corrected the issue in Lotus Domino 5.0.9a.


Lotus Domino 4.6.1

• Lotus Domino 5.0.9a
  http://notes.net/qmrdown.nsf

Lotus Domino 4.6.3

• Lotus Domino 5.0.9a
  http://notes.net/qmrdown.nsf

Lotus Domino 4.6.4

• Lotus Domino 5.0.9a
  http://notes.net/qmrdown.nsf

Lotus Domino 5.0

• Lotus Domino 5.0.9a
  http://notes.net/qmrdown.nsf

Lotus Domino 5.0.1

• Lotus Domino 5.0.9a
  http://notes.net/qmrdown.nsf

Lotus Domino 5.0.2

• Lotus Domino 5.0.9a
  http://notes.net/qmrdown.nsf

Lotus Domino 5.0.3

• Lotus Domino 5.0.9a
  http://notes.net/qmrdown.nsf

Lotus Domino 5.0.4

• Lotus Domino 5.0.9a
  http://notes.net/qmrdown.nsf

Lotus Domino 5.0.5

• Lotus Domino 5.0.9a
  http://notes.net/qmrdown.nsf

Lotus Domino 5.0.6

• Lotus Domino 5.0.9a
  http://notes.net/qmrdown.nsf

Lotus Domino 5.0.7

• Lotus Domino 5.0.9a
  http://notes.net/qmrdown.nsf

Lotus Domino 5.0.8

• Lotus Domino 5.0.9a
  http://notes.net/qmrdown.nsf

Lotus Domino 5.0.9

• Lotus Domino 5.0.9a
  http://notes.net/qmrdown.nsf

Lotus Domino Webserver DOS Device Extension Denial of Service Vulnerability

References:

• Lotus Domino Product Homepage (IBM)
  
• Notes/Domino Updates: MR and MU Incremental Installers (Lotus)