IBM patches Notes and Domino flaws
Four vulnerabilities closed down.
By Gregg Keizer, Computerworld | Published: 09:32, 26 October 2007
IBM has patched four vulnerabilities in its Notes and Domino email software, plugging holes that could be used to access information or infect systems with malicious code.
Collectively ranked as "moderately critical" by Danish bug tracker Secunia, the four vulnerabilities involve Notes' IMAP service; its scripting language (LotusScript); the Domino server's command console; and how both Notes and Domino map memory in Windows when they're used in a shared environment such as Citrix.
"Lotus Domino is prone to a vulnerability that may allow attackers to access other users' sessions," said Symantec in an advisory. A Symantec researcher, Ollie Whitehouse, was credited with reporting the memory mapping bug to IBM.
Related Articles on Techworld
"If the Lotus Notes client is used in a Microsoft Terminal Services or Citrix environment, users can read each other's Lotus Notes session data, including items such as email," the Symantec advisory said.
"This vulnerability could also be used to write to the memory mapped files, [allowing] an attacker to potentially inject active content such as Lotus Script."
Rated slightly higher on the threat scoring system that IBM applies to bugs, however, was the IMAP vulnerability, credited to iDefense Labs, a security intelligence firm owned by VeriSign.
Attackers could exploit the IMAP (Internet Message Access Protocol) bug to cause a buffer overflow, which would then allow them to execute malicious code remotely. "Under Windows, the privileges gained are, by default, that of the SYSTEM user," said iDefense in a warning posted this week. "This allows an attacker to take complete control of the compromised system."
The caveat: Attackers must have valid logon credentials for the IMAP service. Those, however, could be obtained in a phishing attack; alternately, a disgruntled employee with access to IMAP could launch an attack.
IBM issued security bulletins this week for each vulnerability, and provided links to updates to versions 7.0.3 and 8.0. that patch the problems. The updates can also be downloaded from the Lotus Upgrade Central website.
