MWR InfoSecurity and TippingPoint's Zero Day Initiative (ZDI) contacted IBM Lotus to report a potential buffer overflow vulnerability with the Lotus Domino iCalendar functionality.
It is possible to cause a buffer overflow situation based on the iCalendar content included in a calendar invitation.
To exploit this vulnerability, an attacker would have to send an iCalendar invitation with specific parameters. The vulnerability is exposed when the Domino server goes to process that content which could result in remote execution of code.
(Original publish date September 14, 2010. See "Change History" below.)
Resolving the problem
For related information, see the following advisories:
- MWR InfoSecurity: http://labs.mwrinfosecurity.com/advisories/lotus_domino_ical_stack_buffer_overflow
- TippingPoint's ZDI: http://zerodayinitiative.com/advisories
This issue was reported to Quality Engineering as SPR# NRBY7ZPJ9V. To address the issue, customers are encouraged to upgrade to the following releases:
There are no known workarounds.
|Security Rating using Common Vulnerability Scoring System (CVSS) v2|
|CVSS Base Score: < 9.3 >
---- Impact Subscore: < 10 >
---- Exploitability Subscore: < 8.6 >
CVSS Temporal Score: < 7.3 >
CVSS Environmental Score: < Undefined* >
Overall CVSS Score: < 7.3 >
|Base Score Metrics:
|Temporal Score Metrics:
*The CVSS Environment Score is customer environment-specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the referenced links.
|10 October 2010||Updated product versions list.|
|14 September 2010||Initial publication.|
|Messaging Applications||IBM Notes||Calendaring and Scheduling|