IBM Lotus Domino Server Controller Authentication Bypass Remote Code Execution Vulnerability
Category IBM/Lotus
From ZDI: IBM Lotus Domino Server Controller Authentication Bypass Remote Code Execution Vulnerability
Affected Products
Lotus Domino
Vulnerability Details
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Lotus Domino Server Controller. Authentication is not required to exploit this vulnerability.
The flaw exists within the remote console functionality which listens by default on TCP port 2050. When handling A user authentication the server uses a user supplied COOKIEFILE path to retrieve stored credentials. The application then compares this data against the user provided username and cookie. The path to the COOKIEFILE can be a UNC path allowing the attacker to control both the known good credentials and the challenge credentials. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
From ZDI: IBM Lotus Domino Server Controller Authentication Bypass Remote Code Execution Vulnerability
Affected Products
Lotus Domino
Vulnerability Details
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Lotus Domino Server Controller. Authentication is not required to exploit this vulnerability.
The flaw exists within the remote console functionality which listens by default on TCP port 2050. When handling A user authentication the server uses a user supplied COOKIEFILE path to retrieve stored credentials. The application then compares this data against the user provided username and cookie. The path to the COOKIEFILE can be a UNC path allowing the attacker to control both the known good credentials and the challenge credentials. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
Vendor Response
IBM states:
March 22, 2011 - This vulnerability
is being disclosed publicly without a patch in accordance with the ZDI
180 day deadline.
-- Mitigations:
Setting a console password provides another level of authentication and
limits the commands available in the console.
To further mitigate this vulnerability access to 2050/tcp on hosts running
the Domino Server Controller application should be restricted to authorized
hosts.
Disclosure Timeline
2010-09-23 - Vulnerability reported
to vendor
2011-03-22 - Coordinated public release of advisory
| Permalink |
Comments
Posted by Martijn de Jong At 14:16:44 On 23/03/2011 | - Website - |
Posted by Wolfgang Haderlein At 03:52:17 On 13/05/2011 | - Website - |