Vulnerability CVE-2003-0178


Published: 2003-04-02   Modified: 2012-02-12

Description:
Multiple buffer overflows in Lotus Domino Web Server before 6.0.1 allow remote attackers to cause a denial of service or execute arbitrary code via (1) the s_ViewName option in the PresetFields parameter for iNotes, (2) the Foldername option in the PresetFields parameter for iNotes, or (3) a long Host header, which is inserted into a long Location header and used during a redirect operation.

Vendor: IBM
Product: Lotus domino web server 
Version: 6.0;

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0080.html
http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0081.html
http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0082.html
http://marc.info/?l=bugtraq&m=104550063431461&w=2
http://marc.info/?l=bugtraq&m=104550063431463&w=2
http://marc.info/?l=bugtraq&m=104550335103136&w=2
http://marc.info/?l=ntbugtraq&m=104558777331345&w=2
http://marc.info/?l=ntbugtraq&m=104558777531350&w=2
http://marc.info/?l=ntbugtraq&m=104558778331387&w=2
http://www.cert.org/advisories/CA-2003-11.html
http://www.ciac.org/ciac/bulletins/n-065.shtml
http://www.kb.cert.org/vuls/id/206361
http://www.kb.cert.org/vuls/id/542873
http://www.kb.cert.org/vuls/id/772817
http://www.nextgenss.com/advisories/lotus-hostlocbo.txt
http://www.nextgenss.com/advisories/lotus-inotesoflow.txt
http://www.securityfocus.com/bid/6870
http://www.securityfocus.com/bid/6871
https://exchange.xforce.ibmcloud.com/vulnerabilities/11336
https://exchange.xforce.ibmcloud.com/vulnerabilities/11337

Related CVE
CVE-2019-4473
Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984.
CVE-2019-4284
IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token that is printed to log files, which could be used to log in to the system as another user. IBM X-Force ID: 160512.
CVE-2019-4261
IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caused by specially crafted messages. IBM X-Force ID: 160013.
CVE-2019-4275
IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow an unauthorized local user to create unique catalog names that could cause a denial of service. IBM X-Force ID: 160296.
CVE-2019-4165
IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow a remote attacker to cause a denial of service attack using repeated requests to the server. IBM X-Force ID: 158698.
CVE-2019-4163
IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow an authenticated user to obtain sensitive information that a privileged user should only be allowed to view. IBM X-Force ID: 158696.
CVE-2019-4456
IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume ...
CVE-2019-4285
IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could send a specially-crafted HTTP request to ...

Copyright 2019, cxsecurity.com

 

Back to Top