what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

VIGILANTE-2000011.txt

VIGILANTE-2000011.txt
Posted Sep 13, 2000
Authored by Vigilante | Site vigilante.com

Vigilante Advisory #11 - Lotus Domino ESMTP Service Lotus Domino Release 5.0.2a contains a buffer overflow in the processing of SMTp commands, causing the service to crash. Tested on OS/2 Warp 4.5, it is assumed that other platforms are vulnerable as well.

tags | exploit, overflow
SHA-256 | 899917d16df031887b0b09207f33847668e2d85bd87d183da90737c8950ead90

VIGILANTE-2000011.txt

Change Mirror Download
Lotus Domino ESMTP Service Buffer overflow

Advisory Code: VIGILANTE-2000011

Release Date:
September 11, 2000

Systems Affected:
Lotus Domino Release 5.0.2a (Intl) ESMTP Service on OS/2 Warp 4.5
Lotus Domino Release 5.0.2c (Intl) ESMTP Service on OS/2 Warp 4.5
Earlier versions of the ESMTP service can be vulnerable. ESMTP service on
other operating systems can be vulnerable as well. This has not been tested.


THE PROBLEM
When opening a connection to the SMTP service and filling the arguments to
the following commands:
?rcpt to?
?saml from?
?soml from?
with a buffer of size 4096 chars the service will crash. This is similar to
the ?mail from? denial-of-service vulnerability reported in
http://www.securityfocus.com/vdb/bottom.html?vid=1229
The service will also crash when the command ?mail from? receives an
argument on a size of 4096 chars but that is a known vulnerability.

Vendor Status:
Lotus Denmark was contacted on the 11th of August. The 29th of August we
received notification regarding a fix.

Fix (quote from the vendor):

? 5/25/00 fix smtp crash with long mail from. (SPR WAT4KKHUR) Fix is based
on build v504_05192000

6/19/00 More denial of service attack fixes (SPR JSHY4HEV9B) Fix is based on
build v505_05312000 ?

Fix SPR JSHY4HEV9B should be available in the beginning of September.

Please contact Lotus support for information on location on SPR JSHY4HEV9B.

Vendor URL: http://www.lotus.com/
Product URL: http://www.lotus.com/home.nsf/welcome/dominomailserver
Copyright VIGILANTe 2000-08-11

Disclaimer:
The information within this document may change without notice. Use of
this information constitutes acceptance for use in an AS IS
condition. There are NO warranties with regard to this information.
In no event shall the author be liable for any consequences whatsoever
arising out of or in connection with the use or spread of this
information. Any use of this information lays within the user's
responsibility.

Feedback:
Please send suggestions, updates, and comments to:

VIGILANTe
mailto: swat@vigilante.com
http://www.vigilante.com
Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close