SMTP: IBM Lotus Domino nrouter.exe iCalendar MAILTO Stack Buffer Overflow

This signature detects attempts to exploit a known stack buffer overflow vulnerability in IBM Lotus Domino Server. It is due an error in processing e-mail messages containing iCalendar requests. A remote unauthenticated attacker could leverage this by sending a malicious iCalendar e-mail message to a target server. A successful attack can lead to the execution of arbitrary code on a target server, within the security context of the affected service. In an unsuccessful attack, the target server can terminate abnormally.

Extended Description

IBM Lotus Domino is prone to a remote stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Successfully exploiting this issue may allow remote attackers to execute arbitrary code in the context of the 'nrouter.exe' Lotus Domino server process. Failed attacks will cause denial-of-service conditions. Versions prior to IBM Lotus Domino 8.0.2 Fix Pack 5, 8.5.1 Fix Pack 2, and 8.5.2 are vulnerable.

Affected Products

Ibm lotus_domino

References

BugTraq: 43219

CVE: CVE-2010-3407

URL: http://www-01.ibm.com/support/docview.wss?uid=swg21446515 http://labs.mwrinfosecurity.com/advisories/lotus_domino_ical_stack_buffer_overflow/

Short Name

SMTP:MAL:LOTUS-MAILTO

Severity

Major

Recommended

False

Recommended Action

None

SMTP: IBM Lotus Domino nrouter.exe iCalendar MAILTO Stack Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?