This script is Copyright (C) 2017 Tenable Network Security, Inc.
A business collaboration application running on the remote host is
affected by a key validation vulnerability.
According to its banner, the version of IBM Domino (formerly IBM
Lotus Domino) running on the remote host is 8.5.x or 9.0.x prior to
9.0.1 Fix Pack 8. It is, therefore, affected by a flaw in the TLS
server due to improper validation of Diffie-Hellman parameters. A
man-in-the-middle (MitM) attacker can exploit this, via a small
subgroup attack, to more easily break the encryption and thereby
compromise the connection between the server and clients, resulting in
the disclosure of user authentication credentials.
See also :
Upgrade to IBM Domino version 9.0.1 Fix Pack 8 or later.
Note that users who remain on the following releases may open a
service request with IBM Support for a custom hotfix :
- version 9.0.1 through 9.0.1 Fix Pack 7 Interim Fix 2
- version 9.0 through 9.0 Interim Fix 7
Risk factor :
Medium / CVSS Base Score : 4.3
CVSS Temporal Score : 3.2
Public Exploit Available : false