Short Name |
APP:IBM:LOTUS-NOTES-HTML-OF |
---|---|
Severity |
Major |
Recommended |
No |
Category |
APP |
Keywords |
IBM Lotus Notes HTML Message Handling Buffer Overflow |
Release Date |
2011/07/21 |
Update Number |
1959 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
This signature detects attempts to exploit a known vulnerability in IBM Lotus Notes. It is a result of insufficient boundary checking while parsing HTML formatted email. A remote attacker can exploit this vulnerability by persuade the target user to perform certain operation upon a crafted email message, potentially causing arbitrary code to be injected and executed in the security context of the current user. In an attack case where code injection is not successful, all instances of the vulnerable IBM Lotus Notes application will terminate.
IBM Lotus Notes is prone to a buffer-overflow vulnerability because the application fails to adequately perform boundary checks on user-supplied data. This issue occurs in the 'nnotes.dll' dynamic linked library. Successfully exploiting this issue could allow attackers to execute arbitrary code in the context of the user running the application. Failed exploit attempts will result in a denial-of-service condition.