Original release date: March 26, 2003
Last revised: Apr 02, 2003
A complete revision history can be found at the end of this file.
- Lotus Notes and Domino versions prior to 5.0.12 and 6.0 Gold
- VU#571297 affects
5.0.12, 6.0.1 and prior versions.
Multiple vulnerabilities have been reported to affect Lotus Notes clients
and Domino servers. Multiple reporters, the close timing, and some
ambiguity caused confusion about what releases are vulnerable. We are
issuing this advisory to help clarify the details of the vulnerabilities,
the versions affected, and the patches that resolve these issues.
In February 2003, NGS Software released several advisories
detailing vulnerabilities affecting Lotus Notes and Domino. The
following vulnerabilities reported by NGS Software affect versions of
Lotus Domino prior to 5.0.12 and 6.0:
VU#206361 - Lotus
iNotes vulnerable to buffer overflow via PresetFields FolderName field
Lotus Technical Documentation: KSPR5HUQ59
NGS Software's Advisory: NISR17022003b
Lotus Domino Web Server vulnerable to denial of service via incomplete
Lotus Technical Documentation: KSPR5HTQHS
NGS Software's Advisory: NISR17022003d
VU#542873 - Lotus
iNotes vulnerable to buffer overflow via PresetFields s_ViewName field
Lotus Technical Documentation: KSPR5HUPEK
NGS Software's Advisory: NISR17022003b
VU#772817 - Lotus
Domino Web Server vulnerable to buffer overflow via non-existent
"h_SetReturnURL" parameter with an overly long "Host
Lotus Technical Documentation: KSPR5HTLW6
NGS Software's Advisory: NISR17022003a
The following vulnerability reported by NGS Software affects versions
of Lotus Domino up to and including 5.0.12 and 6.0.1:
VU#571297 - Lotus
Notes and Domino COM Object Control Handler contains buffer overflow
Lotus Technical Documentation: SWG21104543
NGS Software's Advisory: NISR17022003e
originally reported as a vulnerability in an iNotes ActiveX control. The
vulnerable code is not specific to iNotes or ActiveX. The iNotes ActiveX
control was an attack vector for the vulnerability and is not the affected
code base. Because this issue is not specific to ActiveX, Lotus Notes
clients and Domino Servers running on platforms other than Microsoft
Windows may be affected.
In March 2003, Rapid7, Inc. released several advisories. The following
vulnerabilities, reported by Rapid7, Inc., affect versions of
Lotus Domino prior to 5.0.12:
VU#433489 - Lotus
Domino Server susceptible to a pre-authentication buffer overflow during
Lotus Technical Documentation: DBAR5CJJJS
Rapid7, Inc.'s Advisory: R7-0010
VU#411489 - Lotus
Domino Web Retriever contains a buffer overflow vulnerability
Lotus Technical Documentation: KSPR5DFJTR
Rapid7, Inc.'s Advisory: R7-0011
Rapid7, Inc. also discovered that Lotus Domino pre-release and
beta versions of 6.0 were also affected by the following vulnerability:
VU#583184 - Lotus
Domino R5 Server Family contains multiple vulnerabilities in LDAP handling
The release version of Lotus Domino 6.0 is not affected. Only pre-release
and beta versions of 6.0 are affected. VU#583184 was a
regression of the PROTOS
LDAP Test-Suite from CA-2001-18 and
was originally fixed in 5.0.7a.
Lotus Technical Documentation: DWUU4W6NC8
Rapid7, Inc.'s Advisory: R7-0012
The impact of these vulnerabilities range from denial of service to data
corruption and the potential to execute arbitrary code. For details about
the impact of a specific vulnerability, please see the
Most of these vulnerabilities are resolved in versions 5.0.12 and
6.0.1 of Lotus Domino.
"Lotus Notes and Domino COM Object Control Handler contains buffer
overflow," is not resolved in 5.0.12, or 6.0.1. Critical
Fix 1 for 6.0.1 was released on March 18, 2003, to resolve this issue
for both the Notes client and Domino server.
Apply a patch
Patches are available for some vulnerabilities. Please view the individual
notes for specific patch information.
Block access from outside the network perimeter
Lotus Domino servers listen on port 1352/TCP. Notes may also be configured
to listen on other ports, such as NETBIOS, SPX, or XPC. Blocking access to
these ports from machines outside your trusted network perimeter may help
mitigate successful exploitation of these vulnerabilities.
Appendix A - References
Our thanks to NGS Software and Rapid7, Inc. for discovering and
reporting on these vulnerabilities. We also thank the Lotus Security Team
for aiding in the resolution and clarification of these issues.
Feedback on this document can be directed to the author, Jason
Copyright 2003 Carnegie Mellon University.
Mar 26, 2003: Initial release
Apr 02, 2003: Added Clarification that VU#583184 does not affect the
release version of Lotus Domino 6.0, only pre-release and beta versions.