Patch/Configuration Management, Vulnerability Management

Multiple flaws reported in IBM Lotus Domino products

Researchers from numerous security vendors have reported multiple remotely exploitable flaws in IBM Lotus Domino products.

One flaw can be exploited by attackers to conduct a cross-site scripting or DoS attack, according to security advisories.

An attacker can cause a buffer overflow resulting in a DoS attack if the IMAP server task is enabled on the Domino server, according to a Technote advisory released by IBM.

The issue was fixed in Lotus Domino versions 6.5.6 and 7.0.2, according to IBM. It exists in Lotus Domino Server versions 6.5 and 7.0, according to an advisory released today by TippingPoint’s Zero Day Initiative.

TippingPoint researchers reported the flaw to IBM last Aug. 31 and the vendor has protected its own customers against attacks on the flaw since Jan. 5.

Meanwhile, VeriSign iDefense released an advisory today explaining a vulnerability that exists in improper HTML filtering of email message content. Certain code sequences bypass filters and successfully execute JavaScript, according to the iDefense advisory.

The flaw can lead to full compromise of an email account, with contact details sent to the attacker, according to the advisory.

The vulnerability exists in Lotus Domino Web Access 7.0, according to VeriSign.

A flaw in the LDAP server when handling requests was also identified. It can be exploited to cause a buffer overflow and crash the server, according to a Secunia advisory.

Click here to email Online Editor Frank Washkuch Jr.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.