IBM Domino IMAP EXAMINE Command Handling RCE (EMPHASISMINE)

This script is Copyright (C) 2017 Tenable Network Security, Inc.


Synopsis :

A business collaboration application running on the remote host is
affected by a remote code execution vulnerability.

Description :

According to its banner, the version of IBM Domino (formerly IBM Lotus
Domino) running on the remote host is 8.5.1, 8.5.2, or 8.5.3 prior to
8.5.3 FP6 IF17, or else it is 9.0.0 or 9.0.1 prior to 9.0.1 FP8 IF2. It
is, therefore, affected by a remote code execution vulnerability due
to improper validation of user-supplied input when handling the IMAP
EXAMINE command. An authenticated, remote attacker can exploit this,
via a specially crafted mailbox name in an IMAP EXAMINE command, to
cause a stack-based buffer overflow, resulting in a denial of service
condition or the execution of arbitrary code.

EMPHASISMINE is one of multiple Equation Group vulnerabilities and
exploits disclosed on 2017/04/14 by a group known as the Shadow
Brokers.

See also :

http://www-01.ibm.com/support/docview.wss?uid=swg22002280

Solution :

Upgrade to IBM Domino version 8.5.3 FP6 IF17 / 9.0.1 FP8 IF2 or later.

Alternatively, customers using 8.5.1, 8.5.2, and 9.0.0 can open a
service request with IBM Support and reference SPR SKAIALJE9N for a
custom hotfix.

Risk factor :

High / CVSS Base Score : 9.0
(CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS Temporal Score : 8.5
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

Family: Misc.

Nessus Plugin ID: 99689 ()

Bugtraq ID: 98019

CVE ID: CVE-2017-1274

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now