IBM Lotus Notes/Domino SSL handshake memory leak denial of service
| lotus-ssl-handshake-dos (24223) |  Medium Risk |
Description:
IBM Lotus Notes and Lotus Domino is vulnerable to a denial of service attack, caused by a memory leak that can occur during an SSL handshake. A remote attacker could exploit this vulnerability to cause the system to crash.
Consequences:
Denial of Service
Remedy:
Upgrade to the latest version of Lotus Notes or Lotus Domino (6.5.5 or later), refer to IBM Support and Downloads - Fix List for Lotus Notes and Lotus Domino Release 6.5.5 Maintenance Release (MR) for more information. See References.
References:
- IBM Support and Downloads: Fix List for Lotus Notes and Lotus Domino Release 6.5.5 Maintenance Release (MR).
- Notes/Domino Fix List: SPR # MKIN693QUT fixed in 6.5.5; 6.5.4 FP1 release.
- Notes/Domino Fix List: SPR # MKIN67MQVW fixed in 6.5.5; 6.5.4 FP1 release.
- BID-16158: IBM Lotus Domino and Notes Multiple Unspecified Vulnerabilities
- CVE-2006-0121: Multiple memory leaks in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (memory consumption and crash) via unknown vectors related to (1) unspecified vectors during the SSL handshake (SPR# MKIN67MQVW), (2) the stash file during the SSL handshake (SPR# MKIN693QUT), and possibly other vectors. NOTE: due to insufficient information in the original vendor advisory, it is not clear whether there is an attacker role in other memory leaks that are specified in the advisory.
- SA18328: IBM Lotus Domino/Notes Multiple Vulnerabilities
- VUPEN/ADV-2006-0081: IBM Lotus Domino Remote Denial of Service and Unspecified Issues
Platforms Affected:
- IBM Lotus Domino 6.5.0
- IBM Lotus Domino 6.5.1
- IBM Lotus Domino 6.5.2
- IBM Lotus Domino 6.5.3
- IBM Lotus Domino 6.5.4
- IBM Lotus Domino 6.5.4.1
- IBM Lotus Domino 6.5.4.2
- IBM Lotus Domino Enterprise Server 6.5.2
- IBM Lotus Domino Enterprise Server 6.5.4
- IBM Lotus Notes 6.5
- IBM Lotus Notes 6.5.1
- IBM Lotus Notes 6.5.2
- IBM Lotus Notes 6.5.3
- IBM Lotus Notes 6.5.4
Reported:
Jan 03, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net