Researchers from numerous security vendors have reported multiple remotely exploitable flaws in IBM Lotus Domino products.
The issue was fixed in Lotus Domino versions 6.5.6 and 7.0.2, according to IBM. It exists in Lotus Domino Server versions 6.5 and 7.0, according to an advisory released today by TippingPoint’s Zero Day Initiative.
TippingPoint researchers reported the flaw to IBM last Aug. 31 and the vendor has protected its own customers against attacks on the flaw since Jan. 5.
The flaw can lead to full compromise of an email account, with contact details sent to the attacker, according to the advisory.
The vulnerability exists in Lotus Domino Web Access 7.0, according to VeriSign.
A flaw in the LDAP server when handling requests was also identified. It can be exploited to cause a buffer overflow and crash the server, according to a Secunia advisory.
Click here to email Online Editor Frank Washkuch Jr.