Risk: High
IBM's Lotus Software has shipped patches for several high-risk security holes in its popular Notes and Domino product lines.
In an advisory, IBM Corp. said the most serious flaw was a buffer-overrun condition that could be exploited by a malicious user to cause the Lotus Domino server to crash, resulting in a denial-of-service attack.
However, Next Generation Security Software Ltd., the company that discovered and reported the vulnerability, said it could permit the execution of arbitrary code via a maliciously crafted POST request.
NGSS is withholding details on the vulnerabilities until around July 2005 but warned that its internal research has discovered six attack vectors.
Affected products include IBM Lotus Domino 6.x and IBM Lotus Notes 6.x.
Security research outfit Secunia rated the vulnerabilities as "highly critical" and urged users to upgrade to Lotus Notes and Domino release 6.5.4 or 6.0.5.
In a separate alert, IBM said a bug in Lotus Domino could allow malicious HTTP-header injection.
The flaw was confirmed in the "@SetHTTPHeader" function, which can be misused to inject content into the header. "The @SetHTTPHeader function is only available to application developers," IBM explained, noting that the vulnerability requires that the attacker have access to install a rogue application on the Lotus Domino server in order to execute this code.
"The impact of the vulnerability, if exploited, is HTTP response splitting or browser/proxy cache poisoning," the company warned in the advisory.
A third advisory from IBM warned that a format-string error in the Domino server when handling authentication using the NRPC Notes protocol could be exploited via a specially crafted string containing format specifiers.
According to the vendor, successful exploitation crashes the Domino server.
The company also posted a fix for a buffer-overflow condition in the NOTES.INI on the Lotus Notes client. IBM said a successful exploit could cause the client to crash but cannot be remotely exploited by an attacker: Local access to the NOTES.INI file is required.
"This problem has not been demonstrated to result in execution of malicious code," IBM said.