From: Secunia Security Advisories (sec-advsecunia.com)
Date: Thu Jun 24 2004 - 02:50:31 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
Lotus Domino/Notes Cross-Site Scripting and Arbitrary Code Execution

SECUNIA ADVISORY ID:
SA11925

VERIFY ADVISORY:
http://secunia.com/advisories/11925/

CRITICAL:
Moderately critical

IMPACT:
Cross Site Scripting, System access

WHERE:
From remote

SOFTWARE:
Lotus Notes R6.x Client
http://secunia.com/product/387/
Lotus Notes R6.x
http://secunia.com/product/388/
Lotus Domino R6
http://secunia.com/product/720/

DESCRIPTION:
Two vulnerabilities have been discovered in Lotus Notes and Lotus
Domino, which can be exploited by malicious people to conduct
cross-site scripting attacks and compromise a vulnerable system.

1) An unspecified input validation error can reportedly be exploited
to conduct cross-site scripting attacks against users.

2) An input validation error within the Notes URI handler can be
exploited to execute arbitrary code on a user's system by making a
Notes client use a remote, custom configuration file ("notes.ini")
via a UNC path. The configuration will in turn specify a remote data
directory containing malicious DLL files, which will be loaded.

Successful exploitation requires that a user is tricked into viewing
a malicious HTML document or follow a specially crafted link.

SOLUTION:
The vendor reports that the vulnerabilities have been resolved in
versions 6.0.4 and 6.5.2.

PROVIDED AND/OR DISCOVERED BY:
1) Reported by vendor.
2) Jouko Pynnonen

ORIGINAL ADVISORY:
IBM - Cross-site Scripting Vulnerability Addressed in 6.0.4 and
6.5.2:
http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21171253

IBM - Lotus Notes URL Handler Argument Injection Vulnerability:
http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21169510

iDEFENSE:
http://www.idefense.com/application/poi/display?id=111&type=vulnerabilities

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]