Buffer overflow vulnerability in Lotus Notes file viewers (multiple file formats)

Note: This is a Notes client issue; it does not impact the Domino server.

This table shows the specific keyview dll that is vulnerable for each file type.

Workarounds for Notes 7.0.x client versions:

Option 1 : If you cannot immediately upgrade to Lotus Notes 7.0.3, you may correct the issue by copying the dll files from a 7.0.3 release over the versions found in earlier 7.0.x releases. You may obtain the DLLs from a Notes 7.0.3 client in any language. They are not language specific

Option 2 : Alternately, you can disable the affected file viewers by following one of the options in the "How to Disable Viewers within Lotus Notes" section of this technote.


Workaround for Notes 6.x client versions:

(Updated February 12, 2008)

Option 1: Contact IBM Support to obtain the patch for the Notes client.

Option 2: Alternately, you can disable the affected file viewer by following one of the options in the "How to disable viewers within Lotus Notes" section of this technote.


Workaround for Notes 5.x client versions:

If you are interested in protecting yourself from these vulnerabilities, we recommend disabling the viewers as described in the "How to Disable Viewers within Lotus Notes" section of this technote. There is no software fix available for the 5.x Notes client version.

How to disable viewers within Notes:

Option 1 : Delete the keyview.ini file in the Notes program directory. This disables ALL viewers. When a user clicks View (for any file), a dialog box will display with the message "Unable to locate the viewer configuration file."

Option 2 : Delete the problem file .dll file. When a user tries to view the specific file type, a dialog box will display with the message "The viewer display window could not be initialized." All other file types work without returning the error message.

Option 3 : Comment out specific lines in keyview.ini for any references to the problem file (dll). To comment a line, you precede it with a semi-colon (;). When a user tries to view the specific file type, a dialog box will display with the message "The viewer display window could not be initialized."

For example:

[KVDOCVE]
;23=exesr.dll


Additional background:
In general, users are strongly urged to use caution when opening or viewing unsolicited file attachments.

The attachments will not auto-execute upon opening or previewing the email message; the file attachment must be opened by the user using one of the mentioned file viewers. In some cases, further user action is also required to trigger the exploit.