Researchers from numerous security vendors have reported multiple remotely exploitable flaws in IBM Lotus Domino products.One flaw can be exploited by attackers to conduct a cross-site scripting or DoS attack, according to security advisories.
An attacker can cause a buffer overflow resulting in a DoS attack if the IMAP server task is enabled on the Domino server, according to a Technote advisory released by IBM.
The issue was fixed in Lotus Domino versions 6.5.6 and 7.0.2, according to IBM. It exists in Lotus Domino Server versions 6.5 and 7.0, according to an advisory released today by TippingPoint’s Zero Day Initiative.
TippingPoint researchers reported the flaw to IBM last August and the vendor has protected its own customers against attacks on the flaw since January.
The flaw can lead to full compromise of an email account, with contact details sent to the attacker, according to the advisory.
The vulnerability exists in Lotus Domino Web Access 7.0, according to VeriSign.
A flaw in the LDAP server when handling requests was also identified. It can be exploited to cause a buffer overflow and crash the server, according to a Secunia advisory.