Buffer overflow in the IMAP service in IBM Lotus Domino before 6.5.6 FP2, and 7.x before 7.0.3, allows remote authenticated users to execute arbitrary code via a long mailbox name.

The version of Lotus Domino on the remote host appears to be older than 6.5.6 FP2.  According to IBM, such versions may be affected by several security issues, depending on the specific version and its configuration.

The IMAP server component of IBM Lotus Domino Server installed on the remote host fails to properly validate the mailbox name before copying it into a fixed-size stack buffer as part of handling certain unspecified commands.  Using a specially crafted mailbox name to which he is subscribed, an authenticated attacker can leverage this issue to execute arbitrary code remotely. 

Note that successful exploitation typically results in SYSTEM-level access under Windows and non-root access on unix-like systems.

The remote host is running a version of Lotus Domino Server that is prone to multiple attacks against the web server component.  An attacker exploiting these flaws would be able to either view confidential data or execute arbitrary code via a buffer overflow.

ID	Name	Product	Family	Severity
27856	IBM Lotus Domino < 6.5.6 FP2 Multiple Vulnerabilities	Nessus	Gain a shell remotely	critical
27535	IBM Lotus Domino IMAP Service Mailbox Name Overflow	Nessus	Gain a shell remotely	high
4261	Lotus Domino Multiple Vulnerabilities	Nessus Network Monitor	SMTP Servers	critical

Detections

Analytics

CVE-2007-3510

high

Tenable Plugins

critical

high

critical