HTTP: IBM Lotus Notes LZH Attachment Viewer Stack Buffer Overflow

This signature detects attempts to exploit a known code execution vulnerability in IBM Lotus Notes File Viewer. Its due to a stack buffer overflow while parsing headers of LZH files. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the application.

Extended Description

Autonomy KeyView Filter is prone to a buffer-overflow vulnerability because of a failure to properly bounds check user-supplied input. An attacker can exploit this issue by enticing an unsuspecting victim to open a malicious file or email attachment. Successful exploits can allow attackers to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will result in a denial-of-service condition. NOTE: This issue was previously discussed in BID 47962 (IBM Lotus Notes Attachment Handling Multiple Buffer Overflow Vulnerabilities) but has been given its own record to better document it.

Affected Products

Symantec mail_security_for_microsoft_exchange

References

BugTraq: 48018

CVE: CVE-2011-1213

URL: http://www.ibm.com/support/docview.wss?uid=swg21500034

Short Name

HTTP:STC:DL:LOTUS-LZH-BOF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: IBM Lotus Notes LZH Attachment Viewer Stack Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?