IBM Lotus Sametime StMux.exe服务栈溢出漏洞

BUGTRAQ ID: 29328 Lotus Sametime是IBM推出的统一商务协作平台，集成了即时消息与Web会议、语音通讯、移动设备等服务。 Lotus Sametime中默认监听于TCP 1533端口上的Community Services Multiplexer（StMux.exe）服务没有正确地处理超长的URL，通过HTTP与Sametime服务器创建了连接的远程攻击者可以向sscanf函数提交恶意HTTP请求触发栈溢出，导致执行任意代码。 IBM Lotus Sametime 8.0 IBM Lotus Sametime 7.5.1 IBM Lotus Sametime...

IBM Lotus Domino < 8.0.1 / 7.0.3 FP1 Multiple Vulnerabilities

According to its banner, the version of Lotus Domino on the remote host is older than 8.0.1 / 7.0.3 FP1. The web server component of such versions is reportedly affected by a stack overflow that can be triggered by means of a specially crafted 'Accept-Language' request header. While IBM says this...

Immunity Canvas: LOTUS_DOMINO_HTTP

Name| lotusdominohttp ---|--- CVE| CVE-2008-2240 Exploit Pack| CANVAS Description| Lotus Domino 8.0.0 HTTP Server - Accept-Language Overflow Notes| References: http://osvdb.org/show/osvdb/45415 CVE Name: CVE-2008-2240 VENDOR: IBM Notes: Repeatability: One-Shot Date public: 05/20/2008 CVE Url:...

CVE-2008-2240

Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code via a long Accept-Language HTTP header...

DSquare Exploit Pack: D2SEC_LOTUS_DOMINO_HTTP

Name| d2seclotusdominohttp ---|--- CVE| CVE-2008-2240 Exploit Pack| D2ExploitPack Description| IBM Lotus Domino Web Server Accept-Language HTTP Header Buffer Overflow Vulnerability Notes|...

CVE-2008-2410

Cross-site scripting XSS vulnerability in the servlet engine and Web container in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Stack overflow

Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code via a long Accept-Language HTTP header...

Cross site scripting

Cross-site scripting XSS vulnerability in the servlet engine and Web container in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-2240

Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code via a long Accept-Language HTTP header...

CVE-2008-2240

CVE-2008-2240 : IBM Lotus Domino Web Server before 7.0.3 FP1 and 8.x before 8.0.1 is vulnerable to a stack-based buffer overflow triggered by a long Accept-Language HTTP header, allowing remote access to cause a daemon crash or potentially execute arbitrary code. Affected products/versions: Lotus...

CVE-2008-2410

Cross-site scripting XSS vulnerability in the servlet engine and Web container in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-2410

CVE-2008-2410 relates to an XSS vulnerability in the IBM Lotus Domino Web Server’s servlet engine/Web container, affecting Domino before 7.0.3 FP1 and before 8.0.1 (8.x). Connected Nessus data adds that older Domino web server versions may also be affected by a stack overflow via a crafted Accept...

sametime-exploit.txt

!perl "IBM Lotus Sametime" StMUX Stack Overflow Exploit Author: Manuel Santamarina Suarez e-Mail: [email protected] use IO::Socket; use File::Basename; destination TCP port $port = 1533; SE handler Don't use upper-case ASCII characters or 0x00, 0x0a, 0x0b, 0x0d, 0x20 You MUST use a POP/POP/RET...

IBM Lotus Sametime Community Services Multiplexer Stack Overflow Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Sametime. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of long URLs in the Community Services Multiplexer StMux.exe listening on...

IBM Lotus Sametime 8.0 - Multiplexer Buffer Overflow

source: https://www.securityfocus.com/bid/29328/info IBM Lotus Sametime is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. An attacker can exploit this issue to execute arbitra...

IBM Lotus Sametime 8.0 - Multiplexer Buffer Overflow

IBM Lotus Sametime 8.0 - Multiplexer Buffer Overflow source: https://www.securityfocus.com/bid/29328/info IBM Lotus Sametime is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. ...

Lotus Domino cross-site scripting vulnerability

Overview IBM Lotus Domino contains a cross-site scripting vulnerability. IBM Lotus Domino is server software for Lotus Notes, groupware from IBM. Lotus Domino contains a cross-site scripting vulnerability. Impact An attacker could execute an arbitrary script on the web browser of a user who...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Lotus Quickr 8.1 before Hotfix 5 for Windows and AIX, and before Hotfix 3 for i5/OS, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to "WYSIWYG editors."...

CVE-2008-2163

Cross-site scripting XSS vulnerability in IBM Lotus Quickr 8.1 before Hotfix 5 for Windows and AIX, and before Hotfix 3 for i5/OS, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to "WYSIWYG editors."...

CVE-2008-2163

Cross-site scripting XSS vulnerability in IBM Lotus Quickr 8.1 before Hotfix 5 for Windows and AIX, and before Hotfix 3 for i5/OS, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to "WYSIWYG editors."...