IBM Lotus Notes 'cai://' URI Handler Remote Code Execution Vulnerability
BID:46236
Info
IBM Lotus Notes 'cai://' URI Handler Remote Code Execution Vulnerability
| Bugtraq ID: | 46236 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-0912 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 07 2011 12:00AM |
| Updated: | Jun 10 2011 05:30PM |
| Credit: | rgod via the Zero Day Initiative |
| Vulnerable: |
IBM Lotus Notes 8.5.1 IBM Lotus Notes 7.0.3 IBM Lotus Notes 7.0.2 IBM Lotus Notes 7.0.1 IBM Lotus Notes 6.5.6 IBM Lotus Notes 6.5.5 IBM Lotus Notes 6.5.4 IBM Lotus Notes 6.5.3 IBM Lotus Notes 6.5.2 IBM Lotus Notes 6.5.1 IBM Lotus Notes 6.5 IBM Lotus Notes 6.0.5 IBM Lotus Notes 6.0.4 IBM Lotus Notes 6.0.3 IBM Lotus Notes 6.0.2 IBM Lotus Notes 6.0.1 IBM Lotus Notes 6.0 IBM Lotus Notes 5.0.12 IBM Lotus Notes 5.0.3 IBM Lotus Notes 8.5 IBM Lotus Notes 8.0 IBM Lotus Notes 7.0.3 FP1 IBM Lotus Notes 7.0.2 FP2 IBM Lotus Notes 7.0.2 FP1 IBM Lotus Notes 7.0 IBM Lotus Notes 6.5.6 FP2 IBM Lotus Notes 6.5.5 FP3 IBM Lotus Notes 6.5.5 FP2 IBM Lotus Notes 6.5.2 FP1 IBM Lotus Notes 0 |
| Not Vulnerable: |
IBM Lotus Notes 8.5.2 IBM Lotus Notes 8.5.1 FP5 IBM Lotus Notes 8.0.2 FP6 |
Discussion
IBM Lotus Notes 'cai://' URI Handler Remote Code Execution Vulnerability
IBM Lotus Notes is prone to a remote code-execution vulnerability because it fails to properly sanitize input.
Successfully exploiting this issue allows remote attackers to execute arbitrary commands in the context of a user who follows a malicious URI.
IBM Lotus Notes is prone to a remote code-execution vulnerability because it fails to properly sanitize input.
Successfully exploiting this issue allows remote attackers to execute arbitrary commands in the context of a user who follows a malicious URI.
Exploit / POC
IBM Lotus Notes 'cai://' URI Handler Remote Code Execution Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
IBM Lotus Notes 'cai://' URI Handler Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
IBM Lotus Notes 'cai://' URI Handler Remote Code Execution Vulnerability
References:
References:
- IBM Lotus Notes Homepage (IBM)
- ZDI-11-051: IBM Lotus Notes cai URI Handler Remote Code Execution Vulnerability (ZDI Disclosures
- (Feb 2011) Potential security vulnerabilities in Lotus Notes & Domino (ibm)
- ZDI-11-051 IBM Lotus Notes cai URI Handler Remote Code Execution Vulnerability (Zero Day Initiative)