Message-ID: <OFA280F2BA.1AB511CF-ON85256CE8.002D057B@hq.rapid7.com>
From: advisory at rapid7.com (Rapid 7 Security Advisories)
Subject: R7-0011: Lotus Notes/Domino Web Retriever HTTP Status Buffer Overflow

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________
                     Rapid7, Inc. Security Advisory

      Visit http://www.rapid7.com/ to download NeXpose, the
           world's most advanced vulnerability scanner.
       Linux and Windows 2000/XP versions are available now!
_______________________________________________________________________

Rapid7 Advisory R7-0011
Lotus Notes/Domino Web Retriever HTTP Status Buffer Overflow

   Published:  March 12, 2003
   Revision:   1.0
   http://www.rapid7.com/advisories/R7-0011.html

   CVE:           CAN-2003-0123
   Lotus SPR:     KSPR5DFJTR
   IBM Technote:  1105060
   Bugtraq ID:    7038

1. Affected system(s):

   KNOWN VULNERABLE:
    o Lotus Notes/Domino R4.5 server and client
    o Lotus Notes/Domino R4.6 server and client
    o Lotus Notes/Domino R5 server and client
    o Lotus Notes/Domino R6 beta (pre-Gold) server and client

   NOT VULNERABLE:
    o Lotus Notes/Domino R6.0 Gold
    o Lotus Notes/Domino R6.0.1
    o Lotus Notes/Domino R5.0.12

2. Summary

   The Lotus Notes/Domino Web Retriever task is responsible for
   retrieving web pages on behalf of Notes users who want to access the
   web via their Notes server.

   The Web Retriever program will crash when it receives an overly long
   HTTP status line from a remote web server.

   If the Web Retriever is running as a server task, the crash will
   cause a denial of service on the server.

   If the Web Retriever is running locally on a client, the crash will
   bring down the Notes client with it.

3. Vendor status and information

   Lotus
   http://www.lotus.com/
   http://www.ibm.com/

   Lotus was notified and they have fixed this vulnerability.  Lotus is
   tracking this issue with SPR #KSPR5DFJTR.  [1] IBM has also prepared
   Technote #1105060, which discusses this vulnerability.  [2]

   See the References section for more information.

4. Solution

   Users running R5 should upgrade to Notes R5.0.12.  Users of R6
   pre-Gold releases should upgrade R6.0 Gold or higher.  Due to other
   vulnerabilities discovered in R6.0 Gold, you should consider
   upgrading to R6.0.1, which was released in February 2003.

   Domino incremental installers may be downloaded from the following
   URL (which has been wrapped):

   http://www14.software.ibm.com
      /webapp/download/search.jsp?go=y&rs=ESD-DMNTSRVRi&sb=r

   As a workaround, you can disable the Web Retriever task on the
   server.  To do this, first remove the 'Web' entry from the
   ServerTasks line in the server's NOTES.INI file, then issue the
   'tell web quit' command at the server console.

   In addition, consider removing the Web Retrieval database (typically
   /WEB.NSF) or lock down its ACL so that no users can access it.  If
   the Web Retriever is disabled, users probably do not need access to
   this database.

   Notes clients will be vulnerable to this if they are configured to
   use the Notes web browser instead of an external browser program.
   This option can be viewed in the Internet browser section of the
   current Location document.

5. Detailed analysis

   By issuing an overly long status message in its HTTP response, a
   remote server can crash the Web Retriever process.  The response
   line consists of the standard HTTP version and code followed by an
   overly long (~6000 bytes) status message, followed by two carriage
   return/linefeed pairs.

      HTTP/1.1 200 Ax6000<crlf><crlf>

   A response length of around 6000 bytes is usually sufficient to crash
   the Web Retriever.  Using a somewhat smaller buffer will still
   corrupt the heap, but the crash may not occur until the corrupted
   portions of the heap are later used.

6. References

   [1] Lotus SPR #KSPR5DFJTR (URL wrapped)
   http://www-10.lotus.com
      /ldd/r5fixlist.nsf/Search?SearchView&Query=KSPR5DFJTR

   [2] IBM Technote #1105060 (URL wrapped)
   http://www-1.ibm.com
      /support/docview.wss?rs=482&q=Domino&uid=swg21105060

7. Contact Information

   Rapid7 Security Advisories
   Email:   advisory@...id7.com
   Web:     http://www.rapid7.com/
   Phone:   +1 (212) 558-8700

8. Disclaimer and Copyright

   Rapid7, Inc. is not responsible for the misuse of the information
   provided in our security advisories.  These advisories are a service
   to the professional security community.  There are NO WARRANTIES
   with regard to this information.  Any application or distribution of
   this information constitutes acceptance AS IS, at the user's own
   risk.  This information is subject to change without notice.

   This advisory Copyright (C) 2003 Rapid7, Inc.  Permission is
   hereby granted to redistribute this advisory, providing that no
   changes are made and that the copyright notices and disclaimers
   remain intact.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBPnA3MCT52JC2U8wAEQKZzACaA7skzQiEGtJHK9L9wg9c3LCC8/IAnjiD
118kXkEAue28djyYfo0vNfrb
=AeLf
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists