IBM Domino IMAP EXAMINE Command Handling RCE (EMPHASISMINE)

high Nessus Plugin ID 99689

Language:

Synopsis

A business collaboration application running on the remote host is affected by a remote code execution vulnerability.

Description

According to its banner, the version of IBM Domino (formerly IBM Lotus Domino) running on the remote host is 8.5.1, 8.5.2, or 8.5.3 prior to 8.5.3 FP6 IF17, or else it is 9.0.0 or 9.0.1 prior to 9.0.1 FP8 IF2. It is, therefore, affected by a remote code execution vulnerability due to improper validation of user-supplied input when handling the IMAP EXAMINE command. An authenticated, remote attacker can exploit this, via a specially crafted mailbox name in an IMAP EXAMINE command, to cause a stack-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code.

EMPHASISMINE is one of multiple Equation Group vulnerabilities and exploits disclosed on 2017/04/14 by a group known as the Shadow Brokers.

Solution

Upgrade to IBM Domino version 8.5.3 FP6 IF17 / 9.0.1 FP8 IF2 or later.

Alternatively, customers using 8.5.1, 8.5.2, and 9.0.0 can open a service request with IBM Support and reference SPR SKAIALJE9N for a custom hotfix.

Plugin Details

Severity: High

ID: 99689

File Name: domino_swg22002280.nasl

Version: 1.6

Type: remote

Family: Misc.

Published: 4/26/2017

Updated: 4/11/2022

Configuration: Enable paranoid mode, Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2017-1274

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:domino, cpe:/a:ibm:lotus_domino

Required KB Items: Settings/ParanoidReport, Domino/Version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/20/2017

Vulnerability Publication Date: 4/14/2017

Reference Information

CVE: CVE-2017-1274

BID: 98019

CERT: 574401

Detections

Analytics