IBM Lotus Notes Notes URL handler allows execution of code
| lotus-notes-code-execution (16496) |  High Risk |
Description:
Lotus Notes versions 6.0.3 and 6.5 and possibly other versions could allow a remote attacker to execute arbitrary code on the system, caused by a vulnerability in the Notes URL handler. A remote attacker could embed command line arguments to the notes.exe file in a specially-crafted URL request, which would be executed in the victim's Web browser within the security context of the hosting site, once the URL is clicked.
Note: If the Notes client is already running on the victim's workstation, or if Internet shares are restricted using firewall configuration or registry settings, the vulnerability cannot be exploited.
Consequences:
Gain Access
Remedy:
Upgrade to the latest version of Lotus Domino (6.0.4 and 6.5.2 or later), available from the IBM Web site. See References.
References:
- Full-Disclosure Mailing List Wed Jun 23 2004 - 16:05:08 CDT: iDEFENSE Security Advisory 06.23.04: Lotus Notes URI Handler Argument Injection Vulnerability.
- IBM Support Web page: Lotus Notes URL Handler Argument Injection Vulnerability.
- iDEFENSE Security Advisory 06.23.04: Lotus Notes URI Handler Argument Injection Vulnerability.
- BID-10600: IBM Lotus Notes URI Handler Remote Code Execution Vulnerability
- CVE-2004-0480: Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate notes.ini configuration file to notes.exe.
Platforms Affected:
- IBM Lotus Notes 6.0.3
- IBM Lotus Notes 6.5
Reported:
Jun 23, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net