Lotus iNotes Client ActiveX Control Buffer Overrun; Reported by NGSS
Technote (FAQ)
Question
The Lotus Domino Server is vulnerable to an intermittent problem with a script or control invoking a specific backend COM class method with an intentionally very long parameter string. The problem reported to Lotus involved the use of an iNotes ActiveX control on Domino 6.0. This vulnerability can be exploited by a malicious user to bring down the Web server.
Answer
This issue was reported to Lotus Software Quality Engineering, and has been addressed in Notes/Domino 6.0.1 CF1.
Excerpt from the Lotus Notes and Domino Release 6.0.1 CF1 fix list (available at http://www.lotus.com/ldd):
Server
SPR# KSPR5J2QET - Fixed a potential Denial of Service attack. Technote # 1104543.
For more information on the Notes/Domino 6.0.1 Critical Fix 1, refer to the following site:
IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.
Rate this page
Please take a moment to complete this form to help us better serve you.
