Multiple vulnerabilities have been identified in IBM Lotus Domino, which could be exploited by attackers to execute arbitrary commands or scripting code.
The first issue is due to an input validation error in the Active Content Filter feature when processing certain email messages, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected server.
The second vulnerability is due to a buffer overflow error in the CRAM-MD5 authentication mechanism within the IMAP service when processing an overly long username (more than 256 bytes), which could be exploited by remote unauthenticated attackers to crash or compromise an affected server.
The third issue is due to a heap overflow error in the LDAP service that fails to properly handle a DN (Distinguished Name) message with an overly long string (more than 65535 bytes), which could be exploited by by remote unauthenticated attackers to crash or compromise an affected server.
Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.
Feedback If you have additional information or corrections for this security advisory please submit them via our contact form.
