Lotus Domino IMAP Server < 6.5.6 / 7.0.2 FP1 CRAM-MD5 Authentication Overflow

High Nessus Network Monitor Plugin ID 3958

Synopsis

The remote IMAP server is affected by a buffer overflow vulnerability.

Description

The IMAP server component of IBM Lotus Domino Server installed on the remote host fails to check the length of the supplied username in its CRAM-MD5 authentication mechanism before processing it. By supplying a username over 256 bytes, an unauthenticated remote attacker can leverage this issue to crash the affected service and possibly execute arbitrary code remotely.

Solution

Upgrade to version 6.5.6, 7.0.2 FP1 or higher.

See Also

http://www.zerodayinitiative.com/advisories/ZDI-07-011.html

http://archives.neohapsis.com/archives/bugtraq/2007-03/0370.html

http://www-1.ibm.com/support/docview.wss?uid=swg21257028

Plugin Details

Severity: High

ID: 3958

File Name: 3958.prm

Family: IMAP Servers

Published: 2007/03/28

Modified: 2016/01/15

Dependencies: 1086

Nessus ID: 24903

Risk Information

Risk Factor: High

CVSSv2

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 7.3

Temporal Score: 6.8

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Exploitable With

CANVAS (CANVAS)

Core Impact

Reference Information

CVE: CVE-2006-4843, CVE-2007-1739, CVE-2007-1675

BID: 23173, 23172