IBM Lotus Domino HTTP Response Splitting and Cross Site Scripting Vulnerabilities
BID:55095
Info
IBM Lotus Domino HTTP Response Splitting and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 55095 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-3302 CVE-2012-3301 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 15 2012 12:00AM |
| Updated: | Feb 15 2013 08:52PM |
| Credit: | Eugene Dokukin (MustLive) |
| Vulnerable: |
IBM Lotus Domino 8.5.3 IBM Lotus Domino 8.5.2 IBM Lotus Domino 8.5.1 IBM Lotus Domino 8.5 |
| Not Vulnerable: | |
Discussion
IBM Lotus Domino HTTP Response Splitting and Cross Site Scripting Vulnerabilities
IBM Lotus Domino is prone to an HTTP-response-splitting vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and influence how Web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
IBM Lotus Domino is prone to an HTTP-response-splitting vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and influence how Web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
Exploit / POC
IBM Lotus Domino HTTP Response Splitting and Cross Site Scripting Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
Solution / Fix
IBM Lotus Domino HTTP Response Splitting and Cross Site Scripting Vulnerabilities
Solution:
Vendor updates are available. Fixes are scheduled to be released in February 2013. Please see the references for more information.
Solution:
Vendor updates are available. Fixes are scheduled to be released in February 2013. Please see the references for more information.
References
IBM Lotus Domino HTTP Response Splitting and Cross Site Scripting Vulnerabilities
References:
References: