KLA10533 Multiple vulnerabilities in IBM domino

Multiple serious vulnerabilities have been found in IBM Domino. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code or gain privileges.

Below is a complete list of vulnerabilities

1. Unknown vulnerability can be exploited locally via an unknown vectors related to Notes System Diagnostic and LDAP Server;
2. Buffer overflow can be exploited remotely via an unknown vectors related to SSLv2.

Original advisories

IBM advisories

Exploitation

Public exploits exist for this vulnerability.

Related products

IBM-Domino

CVE list

CVE-2015-0134 critical

CVE-2015-0179 high

CVE-2015-0117 critical

Solution

Follow vendor instructions for your versions

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• IBM Domino 8.5 versions earlier than 8.5.3 FP6 IF6IBM Domino 9 versions earlier than 9.0.1 FP3 IF1