Technical Description

Multiple vulnerabilities were identified in IBM Lotus Notes, which could be exploited by remote attackers to execute arbitrary commands or bypass security restrictions.

The first issue is due to a buffer overflow error in "kvarcve.dll" when constructing the full pathname of a compressed file to check for its existence before extracting it from a compressed file, which could be exploited by attackers to compromise a vulnerable system by convincing a user to extract a ZIP archive via the Notes attachment viewer.

The second flaw is due to a buffer overflow error in "uudrdr.dll" when handling UUE files containing an encoded file with an overly long filename, which could be exploited by attackers to compromise a vulnerable system by convincing a user to open a UUE archive via the Notes attachment viewer.

The third vulnerability is due to directory traversal errors in "kvarcve.dll" when generating the preview of a compressed file from ZIP, UUE, and TAR archives, which could be exploited by attackers to delete arbitrary files by convincing a user to preview a malicious file via the Notes attachment viewer.

The fourth issue is due to a buffer overflow error in the TAR reader (tarrdr.dll) when extracting a malformed TAR archive, which could be exploited by attackers to compromise a vulnerable system by convincing a user to extract a malicious archive via the Notes attachment viewer.

The fifth flaw is due to a buffer overflow error in the HTML speed reader (htmsr.dll) when processing a malicious email containing an overly long link beginning with either "http", "ftp", or "//", which could be exploited by attackers to compromise a vulnerable system by convincing a user to follow a malicious link.

The sixth vulnerability is due to a buffer overflow error in the HTML speed reader when handling a specially crafted email containing an overly long link, which could be exploited by attackers to execute arbitrary commands.

Affected Products

IBM Lotus Notes version 6.5.4 and prior
IBM Lotus Notes version 7.0 and prior

Solution

Upgrade to version 6.5.5 or 7.0.1 :
http://www.ibm.com/software/lotus/support/upgradecentral/index.html

References

http://www.vupen.com/english/advisories/2006/0500
http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229918
http://secunia.com/secunia_research/2005-30/advisory
http://secunia.com/secunia_research/2005-32/advisory
http://secunia.com/secunia_research/2005-34/advisory
http://secunia.com/secunia_research/2005-36/advisory
http://secunia.com/secunia_research/2005-37/advisory

Credits

Vulnerabilities reported by Tan Chew Keong and Carsten Eiram.

ChangeLog

2006-02-10 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.