----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,700 different Windows applications.

Request your account, the Secunia Network Software Inspector (NSI):
http://secunia.com/network_software_inspector/

----------------------------------------------------------------------

TITLE:
IBM Lotus Notes Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA27279

VERIFY ADVISORY:
http://secunia.com/advisories/27279/

CRITICAL:
Highly critical

IMPACT:
Exposure of sensitive information, System access

WHERE:
>From remote

SOFTWARE:
IBM Lotus Notes 7.x
http://secunia.com/product/7953/
IBM Lotus Notes 6.x
http://secunia.com/product/388/

DESCRIPTION:
Multiple vulnerabilities have been reported in IBM Lotus Notes, which
can be exploited by malicious, local users to gain knowledge of
potentially sensitive information and by malicious people to bypass
certain security mechanisms or compromise a user's system.

1) Errors within various third-party file viewers (mifsr.dll,
awsr.dll, kpagrdr.dll, exesr.dll, rtfsr.dll, mwsr.dll, exesr.dll,
wp6sr.dll, and lasr.dll) can be exploited to cause buffer overflows
by tricking a user into viewing a specially crafted attachment.

Successful exploitation may allow execution of arbitrary code.

2) A boundary error when parsing HTML messages in nnotes.dll can be
exploited to cause a buffer overflow when a user acts upon a
malicious HTML message (e.g. replying, forwarding, or copying it to
the clipboard).

Successful exploitation may allow execution of arbitrary code.

3) An error in the ECL (Execution Control List) mechanism may result
in attachments being executed automatically instead of displaying the
Execution Security Alert when handling Notes database (.nsf) and Notes
template (.ntf) attachments.

4) Insecure permissions on shared memory allows any local user to
access memory containing other users' data.

A bug was also reported, which may crash the client when receiving
specially crafted SMTP responses.

SOLUTION:
Update to version 7.0.3 or 8.0.

NOTE: Version 8.0 does not fix the vulnerability in wp6sr.dll.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) ZDI and Tan Chew-Keong
2) VeriSign iDefense VCP
3) Ed Schaller
4) Ollie Whitehouse, Symantec.

ORIGINAL ADVISORY:
IBM:
http://www-1.ibm.com/support/docview.wss?uid=swg21271111
http://www-1.ibm.com/support/docview.wss?uid=swg21272836
http://www-1.ibm.com/support/docview.wss?uid=swg21272930
http://www-1.ibm.com/support/docview.wss?uid=swg21270884
http://www-1.ibm.com/support/docview.wss?uid=swg21257030
http://www-1.ibm.com/support/docview.wss?uid=swg21271957

Vuln.sg:
http://vuln.sg/lotusnotes702doc-en.html
http://vuln.sg/lotusnotes702sam-en.html
http://vuln.sg/lotusnotes702wpd-en.html
http://vuln.sg/lotusnotes702mif-en.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------