exploit the possibilities

IBM Lotus Domino 8.5.3 XSS / HTTP Response Splitting

IBM Lotus Domino 8.5.3 XSS / HTTP Response Splitting
Posted Aug 31, 2012
Authored by MustLive

IBM Lotus Domino versions 8.5.3 and below suffer from multiple cross site scripting and HTTP response splitting vulnerabilities.

tags | advisory, web, vulnerability, xss
advisories | CVE-2012-3301, CVE-2012-3302
MD5 | 5855048b4dbfa5a87db8cf3605e761fa

IBM Lotus Domino 8.5.3 XSS / HTTP Response Splitting

Change Mirror Download
Hello list!

This month (at 15th of August) IBM released the advisory about IBM Lotus
Domino Cross-Site Scripting and HTTP Response Splitting vulnerabilities,
which I've informed them about in May. This is only the part of all
vulnerabilities, which I've found in their software, and they are working to
fix other vulnerabilities.

IBM Security Bulletin: Aug-2012 IBM Lotus Domino Web Server Cross-Site
Scripting Vulnerabilities
http://www-01.ibm.com/support/docview.wss?uid=swg21608160

CVE IDs: CVE-2012-3301, CVE-2012-3302.

Note, that regardless in title are mentioned only Cross-Site Scripting
vulnerabilities, there is also HTTP Response Splitting described in it.

-------------------------
Affected products:
-------------------------

Vulnerable are IBM Lotus Domino 8.5.3 and previous versions. These
vulnerabilities will be fixed in Domino 8.5.4.

For fixes, workarounds and mitigations reference to above-mentioned IBM
Security Bulletin.

While fixes for all vulnerabilities are planned for inclusion in Domino
8.5.4, workarounds exist for some of them in Domino servers 7.0 and later by
enabling a single INI setting (see bellow).

----------
Details:
----------

In the advisory IBM mentioned four vulnerabilities.

1. IBM Lotus Domino WebMail Cross-Site Scripting.
CVE ID: CVE-2012-3302

2. IBM Lotus Domino Help Cross-Site Scripting on HTTP Server.
CVE ID: CVE-2012-3302

3. IBM Lotus Domino HTTP Server Response Splitting.
CVE ID: CVE-2012-3301

4. IBM Lotus Domino HTTP Server Response Splitting.
CVE ID: CVE-2012-3301

The first one is in reality 2 XSS holes (in Webmail) and the second one is
in reality four XSS holes (in Help). It's just IBM like to put multiple
vulnerabilities of the same type into one vulnerability in their advisories.
The third one is XSS via HTTP Response Splitting (variation of the fourth
vulnerability). IBM put all the holes in their own order, different then I
sent them.

Note, that there is inaccuracy in the description of the third vulnerability
(concerning browsers vulnerable to this attack). Earlier I've already
informed IBM about this inaccuracy and they should fix it.

------------------
Workaround:
------------------

There is a workaround for all mentioned in the advisory XSS vulnerabilities:

To avoid this attack, administrators can set the following variable on the
Domino server NOTES.INI, available in release 7.0 and later:

DominoValidateFramesetSRC=1

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    34 Files
  • 2
    Jul 2nd
    15 Files
  • 3
    Jul 3rd
    9 Files
  • 4
    Jul 4th
    8 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    3 Files
  • 7
    Jul 7th
    1 Files
  • 8
    Jul 8th
    15 Files
  • 9
    Jul 9th
    15 Files
  • 10
    Jul 10th
    20 Files
  • 11
    Jul 11th
    17 Files
  • 12
    Jul 12th
    16 Files
  • 13
    Jul 13th
    2 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    20 Files
  • 16
    Jul 16th
    27 Files
  • 17
    Jul 17th
    7 Files
  • 18
    Jul 18th
    5 Files
  • 19
    Jul 19th
    12 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close