Vulnerability Note VU#571297
Lotus Notes and Domino COM Object Control Handler contains buffer overflow
Lotus Notes is a client application that provides access to Lotus Domino servers. A vulnerability exists that could permit a remote attacker to cause a user to execute arbitrary code.
A buffer overflow vulnerability exists in the in both Lotus Notes clients and Domino Servers in a backend COM class method that handles controls. If a remote attacker could trick a victim into viewing a malicious web page or email message, the attacker could exploit this buffer overflow to execute arbitrary code on the system.
This was originally reported as a vulnerability in an iNotes ActiveX control. The vulnerable code is not iNotes or ActiveX specific, this was an attack vector, not the affected code base.
A remote attacker could crash the Notes client or Domino server and potentially execute arbitrary code on the system with the privileges of the current user. This is not Microsoft Windows platform specific and can affect other platforms.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Lotus Software||Affected||17 Feb 2003||17 Mar 2003|
CVSS Metrics (Learn More)
Thanks to Mark Litchfield for reporting this vulnerability.
This document was written by Jason A Rafail.
- CVE IDs: Unknown
- CERT Advisory: CA-2003-11
- Date Public: 17 Feb 2003
- Date First Published: 19 Feb 2003
- Date Last Updated: 26 Mar 2003
- Severity Metric: 8.35
- Document Revision: 22
If you have feedback, comments, or additional information about this vulnerability, please send us email.