SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   IBM iNotes and Domino Vendors:   IBM
IBM Lotus Notes Lets Local Users Modify Critical Files
SecurityTracker Alert ID:  1017086
SecurityTracker URL:  http://securitytracker.com/id/1017086
CVE Reference:   CVE-2005-2454   (Links to External Site)
Date:  Oct 18 2006
Impact:   Modification of user information, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.5.4, 6.5.5, 7.0.0, 7.0.1
Description:   A vulnerability was reported in IBM Lotus Notes. A local user can modify Notes program and data files.

The client software installation process grants "Full Control" access privileges for the Notes program and data directory to the "Everyone" group on Windows-based systems.

A local user can add, remove, modify, or replace files in those directories.

The vendor was notified on July 22, 2005.

Carsten Eiram of Secunia Research discovered this vulnerability.

The original advisory is available at:

http://secunia.com/secunia_research/2005-29/advisory/

Impact:   A local user can modify Notes application and program files.
Solution:   The vendor has fixed the installation process for version 7.0.2. Some workarounds for previous version installations are described in the IBM advisory.

The IBM advisory is available at:

http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21246773

Cause:   Configuration error
Underlying OS:  Windows (NT), Windows (2000), Windows (XP)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC