----------------------------------------------------------------------

Do you need accurate and reliable IDS / IPS / AV detection rules?

Get in-depth vulnerability details:
http://secunia.com/binary_analysis/sample_analysis/

----------------------------------------------------------------------

TITLE:
IBM Lotus Quickr Security Issue and Denial of Service

SECUNIA ADVISORY ID:
SA32098

VERIFY ADVISORY:
http://secunia.com/advisories/32098/

CRITICAL:
Moderately critical

IMPACT:
Privilege escalation, DoS

WHERE:
>From remote

SOFTWARE:
IBM Lotus Quickr 8.x
http://secunia.com/advisories/product/17586/

DESCRIPTION:
A security issue and a vulnerability have been reported in IBM Lotus
Quickr, which can be exploited by malicious users to perform certain
actions with escalated privileges and potentially by malicious people
to cause a DoS (Denial of Service).

1) An unspecified error in the processing of the OpenDocument command
can be exploited to cause the server to crash via a specially crafted
URL argument.

2) A security issues exists due to a place manager being able to
delete a place superuser group.

The vulnerability and the security issue are reported in versions
prior to 8.1.0.1.

SOLUTION:
Update to version 8.1.0.1.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

CHANGELOG:
2008-10-09: Updated vulnerability #2 based on vendor information.
Updated "Original Advisory" section.

ORIGINAL ADVISORY:
IBM (THES7BZM66, XFXF7HF5HB):
http://www-01.ibm.com/support/docview.wss?uid=swg27013341

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------