Lotus iNotes ActiveX控件URL处理栈溢出漏洞

BUGTRAQ ID: 38457 CVECAN ID: CVE-2010-0919 Lotus iNotes之前被称为Lotus Domino Web Access，是Lotus Domino服务器基于web的消息和协作界面。 Domino Web Access ActiveX控件（dwa8.dll，dwa8w.dll）在处理URL时没有执行长度检查便将其拷贝到了固定大小的栈缓冲区中，用户受骗访问了恶意网页并传送了超长参数的话就可以触发栈溢出，导致执行任意代码。 IBM Lotus iNotes 8.0 IBM Lotus iNotes 7.0 IBM Lotus iNotes 6.5...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 allows remote attackers to inject arbitrary web script or HTML via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."...

CVE-2010-0921

Cross-site request forgery CSRF vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 allows remote attackers to hijack the authentication of unspecified victims via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."...

CVE-2010-0919

Stack-based buffer overflow in the Lotus Domino Web Access ActiveX control in IBM Lotus iNotes aka Domino Web Access or DWA 6.5, 7.0 before 7.0.4, 8.0, 8.0.2, and before 229.281 for Domino 8.0.2 FP4 allows remote attackers to execute arbitrary code via a long URL argument to an unspecified method...

CVE-2010-0918

Multiple unspecified vulnerabilities in the UltraLite functionality in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 have unknown impact and attack vectors...

Design/Logic Flaw

Multiple unspecified vulnerabilities in the UltraLite functionality in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 have unknown impact and attack vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 allows remote attackers to hijack the authentication of unspecified victims via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."...

CVE-2010-0920

Cross-site scripting XSS vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 allows remote attackers to inject arbitrary web script or HTML via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."...

CVE-2010-0919

The CVE-2010-0919 issue is a stack-based buffer overflow in the Lotus Domino Web Access ActiveX control (dwa8.dll/dwa8w.dll) used by IBM Lotus iNotes. The vulnerability arises when processing a long URL argument, copying it into a fixed-size stack buffer without length checks, which can lead to r...

CVE-2010-0918

Technical details for CVE-2010-0918 are not publicly available in the provided documents. The records describe unspecified vulnerabilities with unknown impact and vectors. Monitor for updates from vendors and threat feeds.

CVE-2010-0920

CVE-2010-0920 affects IBM Lotus iNotes (Domino Web Access) prior to 229.281 for Domino 8.0.2 FP4, exposing an XSS vulnerability via flaws in the XSS/CSRF Get Filter and Referer Check fixes. Affected component: iNotes/DWA web interface; vulnerability type: Cross-site scripting. Root cause: lack of...

CVE-2010-0920

Cross-site scripting XSS vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 allows remote attackers to inject arbitrary web script or HTML via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."...

CVE-2010-0921

Cross-site request forgery CSRF vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 allows remote attackers to hijack the authentication of unspecified victims via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."...

CVE-2010-0918

Multiple unspecified vulnerabilities in the UltraLite functionality in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 have unknown impact and attack vectors...

CVE-2010-0919

Stack-based buffer overflow in the Lotus Domino Web Access ActiveX control in IBM Lotus iNotes aka Domino Web Access or DWA 6.5, 7.0 before 7.0.4, 8.0, 8.0.2, and before 229.281 for Domino 8.0.2 FP4 allows remote attackers to execute arbitrary code via a long URL argument to an unspecified method...

Buffer Overflow Flaw in Lotus' iNotes

The Lotus iNotes ActiveX control for reading email from within a browser contains a programming error which can result in a buffer overflow. This could be exploited by an attacker to infect an iNotes user with spyware on visiting a crafted web page. Read the full article. The H Security...

CVE-2010-0274

Unspecified vulnerability in the Edit Contact scene in Ultra-light Mode in IBM Lotus iNotes aka Domino Web Access or DWA before 229.241 for Domino 8.0.2 FP3 has unknown impact and attack vectors, aka SPR LSHR7TBLY5...

CVE-2009-4594

Unspecified vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 229.131 for Domino 8.0.x has unknown impact and attack vectors, aka SPR SDOY7RHBNH...

CVE-2010-0276

IBM Lotus iNotes aka Domino Web Access or DWA before 229.241 for Domino 8.0.2 FP3 does not properly handle navigation of the "Try Lotus iNotes anyway" link from the page that reports use of an unsupported browser, which has unspecified impact and attack vectors, aka SPR LSHR7TBMQU...

CVE-2010-0275

Ultra-light Mode in IBM Lotus iNotes aka Domino Web Access or DWA before 229.241 for Domino 8.0.2 FP3 does not properly handle script commands in the status-alerts URL, which has unspecified impact and attack vectors, aka SPR LSHR7TBM58...