«
Expand/Collapse
79 items tagged "lotus"
Related tags:
safer use [+],
buffer overflow vulnerability [+],
buffer overflow [+],
notes [+],
domino server [+],
domino icalendar [+],
zero day [+],
service vulnerability [+],
email [+],
cms [+],
arbitrary code [+],
txt [+],
technology [+],
oracle [+],
lotus domino server [+],
lotus 6 [+],
lotus 123 [+],
denial [+],
authentication [+],
mailto [+],
email attachment [+],
denial of service [+],
buffer [+],
autonomy [+],
ibm [+],
service [+],
overflow vulnerability [+],
multiple buffer overflow [+],
mailbox account [+],
lotus symphony [+],
lotus notes [+],
keyview [+],
http [+],
fraise [+],
forgery [+],
exploits [+],
domino authentication [+],
disclosure [+],
content [+],
bypass [+],
bugtraq [+],
buffer overflow vulnerabilities [+],
arbitrary code execution [+],
xls [+],
whitepaper [+],
symphony office [+],
stack overflow [+],
scanner [+],
poc [+],
pdf [+],
nsf [+],
lotus version [+],
lotus notes domino [+],
hijacking [+],
domino remote [+],
criando [+],
controller [+],
console [+],
code [+],
ascii string [+],
vulnerability [+],
lotus domino [+],
domino [+],
zdi [+],
windows [+],
vulnerabilities [+],
target address [+],
symphony [+],
surunas [+],
router [+],
retired [+],
request [+],
remote buffer overflow [+],
remote [+],
password storage [+],
paper [+],
overflow [+],
operation [+],
nsfcomputeevaluateext [+],
note [+],
nldap [+],
mobile [+],
memory corruption [+],
lotus notes client [+],
integer overflow vulnerability [+],
install [+],
insecure password [+],
information disclosure vulnerability [+],
image object [+],
heap [+],
hackproofing [+],
exploit [+],
email server [+],
domino web server [+],
domino version [+],
domino smtp [+],
domino rpc [+],
domino event [+],
domino current [+],
domino base [+],
document attachment [+],
day [+],
david litchfield [+],
black hat [+],
bind request [+],
biff [+],
authors [+],
code execution [+],
stack buffer [+]
-
-
8:35
»
Packet Storm Security Recent Files
IBM Lotus Notes/Domino server suffers from a remote denial of service vulnerability that can be triggered by a malformed TCP packet. Versions 8.5.2 FP3 and earlier, 8.5.1, 8.5 and 8.0.x are affected.
-
8:35
»
Packet Storm Security Misc. Files
IBM Lotus Notes/Domino server suffers from a remote denial of service vulnerability that can be triggered by a malformed TCP packet. Versions 8.5.2 FP3 and earlier, 8.5.1, 8.5 and 8.0.x are affected.
-
-
10:39
»
SecuriTeam
A stack buffer overflow vulnerability in IBM Corp.'s Lotus Notes could allow an attacker to execute arbitrary code in the context of the current user.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
10:39
»
SecuriTeam
A stack buffer overflow vulnerability in IBM Corp.'s Lotus Notes could allow an attacker to execute arbitrary code in the context of the current user.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
10:29
»
SecuriTeam
A stack buffer overflow vulnerability in IBM Corp.'s Lotus Notes could allow an attacker to execute arbitrary code in the context of the current user.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
15:44
»
SecuriTeam
A stack buffer overflow vulnerability in IBM Corp.'s Lotus Notes could allow an attacker to execute arbitrary code in the context of the current user.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
19:07
»
SecuriTeam
A memory corruption vulnerability can be triggered when a Lotus Notes client parses a .XLS file with a specially crafted BIFF record.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
20:59
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Lotus Domino Server Controller.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
19:49
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Domino.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
17:58
»
Packet Storm Security Exploits
This Metasploit module exploits a vulnerability found in IBM Lotus Domino iCalendar. By sending a long string of data as the "ORGANIZER;mailto" header, process "nRouter.exe" crashes due to a Cstrcpy() routine in nnotes.dll, which allows remote attackers to gain arbitrary code execution. Note: In order to trigger the vulnerable code path, a valid Domino mailbox account is needed.
-
17:58
»
Packet Storm Security Recent Files
This Metasploit module exploits a vulnerability found in IBM Lotus Domino iCalendar. By sending a long string of data as the "ORGANIZER;mailto" header, process "nRouter.exe" crashes due to a Cstrcpy() routine in nnotes.dll, which allows remote attackers to gain arbitrary code execution. Note: In order to trigger the vulnerable code path, a valid Domino mailbox account is needed.
-
17:58
»
Packet Storm Security Misc. Files
This Metasploit module exploits a vulnerability found in IBM Lotus Domino iCalendar. By sending a long string of data as the "ORGANIZER;mailto" header, process "nRouter.exe" crashes due to a Cstrcpy() routine in nnotes.dll, which allows remote attackers to gain arbitrary code execution. Note: In order to trigger the vulnerable code path, a valid Domino mailbox account is needed.
-
-
21:26
»
Packet Storm Security Exploits
Lotus CMS version 3.0.3 suffers from cross site request forgery, file content disclosure, and cross site scripting vulnerabilities.
-
-
17:33
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on systems with vulnerable installations of IBM Lotus Domino.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
13:42
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Notes Email Client.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
13:42
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Notes Email Client.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
13:37
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Notes Email Client.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
23:54
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Notes Email Client.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
18:47
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 10-156 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Notes Email Client. User interaction is required to exploit this vulnerability in that the target must open a malicious email attachment. The specific flaw exists within the Lotus Notes file viewer utilizing the KeyView SDK to render a malformed Word document. The application will copy an arbitrarily sized ASCII string representing the font name into a constant sized buffer located on the stack. If large enough this will lead to a buffer overflow and can lead to code execution under the context of the application.
-
18:47
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 10-157 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Notes Email Client. User interaction is required to exploit this vulnerability in that the target must open a malicious email attachment. The specific flaw exists within the Lotus Notes file viewer utilizing the KeyView SDK to render a Word document containing a malformed shape. The application will calculate a length incorrectly when using it to copy data into an allocated buffer. This can lead to code execution under the context of the application.
-
18:47
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 10-159 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Notes Email Client. User interaction is required to exploit this vulnerability in that the target must open a malicious email attachment. The specific flaw exists within the Lotus Notes file viewer utilizing the KeyView SDK to render a malformed .wk3 document. The application will trust a length specified in the file in order to read a number of bytes into a statically allocated buffer. This leads to a buffer overflow and can lead to code execution under the context of the application.
-
18:47
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 10-156 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Notes Email Client. User interaction is required to exploit this vulnerability in that the target must open a malicious email attachment. The specific flaw exists within the Lotus Notes file viewer utilizing the KeyView SDK to render a malformed Word document. The application will copy an arbitrarily sized ASCII string representing the font name into a constant sized buffer located on the stack. If large enough this will lead to a buffer overflow and can lead to code execution under the context of the application.
-
18:47
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 10-157 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Notes Email Client. User interaction is required to exploit this vulnerability in that the target must open a malicious email attachment. The specific flaw exists within the Lotus Notes file viewer utilizing the KeyView SDK to render a Word document containing a malformed shape. The application will calculate a length incorrectly when using it to copy data into an allocated buffer. This can lead to code execution under the context of the application.
-
18:47
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 10-159 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Notes Email Client. User interaction is required to exploit this vulnerability in that the target must open a malicious email attachment. The specific flaw exists within the Lotus Notes file viewer utilizing the KeyView SDK to render a malformed .wk3 document. The application will trust a length specified in the file in order to read a number of bytes into a statically allocated buffer. This leads to a buffer overflow and can lead to code execution under the context of the application.
-
-
6:36
»
Carnal0wnage
I pushed out the first of a few Lotus Domino modules I've been working on to the metasploit trunk last nite.
The first one is a
Lotus Domino Version Module.
There is no real "banner grabbing" for versions with Lotus Domino, old old versions "may" display the version in the server headers but I've never seen anything above 5.x do this. You usually get something like:
HTTP/1.0 200 OK
Server: Lotus-Domino
Date: Fri, 30 Apr 2010 00:19:11 GMT
Last-Modified: Wed, 07 Apr 2010 01:39:54 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 5390
Cache-control: private
ETag: W/"MTAtODA4NS1DMTI1NzZENjAwMTVGRDhELTAtMA=="
for headers.
Useful enough to identify that its a Domino web server but not so much for using the couple of remote exploits out there that are very version and/or fixpack dependent.
There are a couple of files that the web server may serve up that have version information.
The first being iNotes/FormsX.nsf that usually has the version information as a comment in the html (this can be turned off) and the second being download/filesets/l_LOTUS_SCRIPT.inf
type files that has the base install version (at least as far as I can tell its the base install). *If thats not right please let me know*
So let's give it a test drive...
msf > use auxiliary/scanner/lotus/lotus_domino_version
msf auxiliary(lotus_domino_version) > info
Name: Lotus Domino Version
Version: $Revision$
License: Metasploit Framework License (BSD)
Rank: Normal
Provided by:
CG
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
PATH / yes path
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 80 yes The target port
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host
Description:
Checks to determine Lotus Domino Server Version.
msf auxiliary(lotus_domino_version) > set RHOSTS file:/home/user/shodan-domino.txt
RHOSTS => file:/home/user/shodan-domino.txt
msf auxiliary(lotus_domino_version) > run
[*] 192.168.245.101:80 Lotus Domino Current Version: 6.5.4 (Windows NT/Intel)
[*] 192.168.245.101:80 Lotus Domino Base Install Version: 6.0.5.50
[*] 192.168.245.101:80 Lotus Domino Base Install Version: 6.0.5.50
[*] 192.168.245.101:80 Lotus Domino Base Install Version: 6.0.5.50
[*] 192.168.245.101:80 Lotus Domino Base Install Version: 6.0.5.50
[*] 192.168.80.132:80 Lotus Domino Current Version: 6.5.5 (Solaris Sparc)
[*] 192.168.80.132:80 Lotus Domino Base Install Version: 6.0.4
[*] 192.168.80.132:80 Lotus Domino Base Install Version: 6.0.4
[-] no response for 192.168.80.132:80 download/filesets/l_SEARCH.inf
[*] 192.168.80.132:80 Lotus Domino Base Install Version: 6.0.4
[*] Scanned 02 of 20 hosts (010% complete)
[*] 192.168.220.33:80 Lotus Domino Current Version: 8.0.2 HF1190 (Windows NT/Intel)
[*] 192.168.220.33:80 Lotus Domino Current Version: 8.0.2 HF1190 (Windows NT/Intel)
[*] 192.168.220.33:80 Lotus Domino Base Install Version: 8.0.1.0
[*] 192.168.220.33:80 Lotus Domino Base Install Version: 8.0.1.0
[*] 192.168.220.33:80 Lotus Domino Base Install Version: 8.0.1.0
[*] 192.168.220.33:80 Lotus Domino Base Install Version: 8.0.1.0
[-] 192.168.152.68:80 302 Redirect to https://192.168.152.68/iNotes/Forms5.nsf
[-] 192.168.152.68:80 302 Redirect to https://192.168.152.68/iNotes/Forms6.nsf
[-] 192.168.152.68:80 302 Redirect to https://192.168.152.68/iNotes/Forms7.nsf
[-] 192.168.152.68:80 302 Redirect to https://192.168.152.68/download/filesets/l_LOTUS_SCRIPT.inf
[-] 192.168.152.68:80 302 Redirect to https://192.168.152.68/download/filesets/n_LOTUS_SCRIPT.inf
[-] 192.168.152.68:80 302 Redirect to https://192.168.152.68/download/filesets/l_SEARCH.inf
[-] 192.168.152.68:80 302 Redirect to https://192.168.152.68/download/filesets/n_SEARCH.inf
[*] Scanned 04 of 20 hosts (020% complete)
[*] 192.168.166.33:80 Lotus Domino Current Version: 7.0.1 (Windows NT/Intel)
[*] 192.168.166.33:80 Lotus Domino Current Version: 7.0.1 (Windows NT/Intel)
[*] 192.168.166.33:80 Lotus Domino Base Install Version: 7.0.1.0
[*] 192.168.166.33:80 Lotus Domino Base Install Version: 7.0.1.0
[*] 192.168.166.33:80 Lotus Domino Base Install Version: 7.0.1.0
[*] 192.168.166.33:80 Lotus Domino Base Install Version: 7.0.1.0
[*] Scanned 06 of 20 hosts (030% complete)
[*] 192.168.33.93:80 Lotus Domino Current Version: 7.0.2 (Windows NT/Intel)
[*] 192.168.33.93:80 Lotus Domino Current Version: 7.0.2 (Windows NT/Intel)
[*] 192.168.33.93:80 Lotus Domino Base Install Version: 7.0.2.0
[*] 192.168.33.93:80 Lotus Domino Base Install Version: 7.0.2.0
[*] 192.168.33.93:80 Lotus Domino Base Install Version: 7.0.2.0
[*] 192.168.33.93:80 Lotus Domino Base Install Version: 7.0.2.0
[*] 192.168.246.154:80 Lotus Domino Current Version: 7.0.3FP1 (Windows NT/Intel)
[*] 192.168.246.154:80 Lotus Domino Current Version: 7.0.3FP1 (Windows NT/Intel)
[*] 192.168.246.154:80 Lotus Domino Base Install Version: 7.0.3.0
[*] 192.168.246.154:80 Lotus Domino Base Install Version: 7.0.3.0
[*] 192.168.246.154:80 Lotus Domino Base Install Version: 7.0.3.0
[*] 192.168.246.154:80 Lotus Domino Base Install Version: 7.0.3.0
...
1337day (was: Inj3ct0r, 1337db)
OSVDB Vulnerabilities
Exploit-DB
SecurityFocus Vulnerabilities
Bugtraq
XSSed
Sophos security news
Penetration Testing
BackTrack Linux Forums
Threatpost
SecDocs
carnal0wnage.attackresearch.com
Darknet
The Exploitant
Hack a Day
Wirevolution