Vulnerability Note VU#772817

Lotus Domino Web Server vulnerable to buffer overflow via non-existent "h_SetReturnURL" parameter with an overly long "Host Header" field

The problem occurs when the web server responds with a "302 Moved Temporarily" redirection error. The "Location:" header contained in this response is composed in part from the Host: header contained in the request. By carefully manipulating the length of the Host: header before and after URL encoding, the attacker can cause the resulting Location: header to contain information in adjacent memory on the web server. This vulnerability was reportedly discovered using a Windows 2000 (SP3) machine running Domino release 6.0.

Further information is available in NGSSoftware advisory NISR17022003a and in IBM Technote 1104529 (SPR# KSPR5HTLW6). This vulnerability is addressed in Domino Release 6.0.1. Domino Release 5 is not affected.

II. Impact

Filter HTTP Requests with Large Headers

Sites that are able to deploy a monitoring system between the Internet and their web server may be able to detect and block packets with large amounts of header data.

http://www.nextgenss.com/advisories/lotus-hostlocbo.txt
http://www-1.ibm.com/support/docview.wss?uid=swg21104529
http://www-1.ibm.com/support/docview.wss?uid=swg27003694
http://www-1.ibm.com/services/continuity/recover1.nsf/4699c03b46f2d4f68525678c006d45ae/85256a3400529a8685256cd7007acda6?OpenDocument

Credit

Thanks to Mark Litchfield of NGSSoftware for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.