Vulnerability Note VU#590487

Lotus Domino vulnerable to directory traversal, aka "Domino Server Directory Transversal Vulnerability"

Original Release date: 10 Jan 2001 | Last revised: 10 Jan 2001

Overview

Lotus Domino web server may allow malformed URL requests to access files outside the document root of a vulnerable system.

Description

A Lotus Domino server running the HTTP task may permit an intruder to read files on file systems or drives that house Lotus Notes databases. By using a specially crafted URL containing ".." and the name of an existing file, an intruder may be able to cause a Domino server to return the contents of the file to the intruder over the HTTP connection. If this file contains sensitive information, an intruder may be able to leverage that information to gain additional access.

Impact

Intruders can read files outside the normal web root of a Domino server.

Solution

Lotus plans on releasing a new version (R5.0.6a) which addresses this problem as soon as possible. See http://www.lotus.com/security for more details. According to Lotus, the SPR (Software Problem Report) number is KSPR4SPQ5S. When an SPR is fixed, it is posted in the Fix List database on Notes.net. In the meantime, a workaround is possible by using the URL redirection feature of Domino.

Redirect URLs of the form *..* to a harmless location or an error page. See the http://www.lotus.com/security for details or consult your Domino documentation.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
LotusAffected06 Jan 200010 Jan 2001
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The CERT/CC would like to acknowledge Katherine Spanbauer, Senior Product Manager, Notes and Domino Security Lotus Development Corporation for her assistance, and independent researcher Georgi Guninski who discovered this problem.

This document was written by Jeffrey S Havrilla and Shawn Hernan.

Other Information

  • CVE IDs: Unknown
  • Date Public: 05 Jan 2001
  • Date First Published: 10 Jan 2001
  • Date Last Updated: 10 Jan 2001
  • Severity Metric: 21.60
  • Document Revision: 19

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.