Published:
25 August 1999
Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-1999.121 -- ISS X-Force Security Advisory Denial of Service Attack against Lotus Notes Domino Server 4.6 26 August 1999 =========================================================================== ISS X-Force has released the following advisory concerning a vulnerability in the Notes LDAP Service (NLDAP) where an ldap_search request with a large amount of data can cause a PANIC in the Domino Server. This vulnerability may allow remote users to stop all Domino services running on the affected server. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- ISS Security Advisory August 23, 1999 Denial of Service Attack against Lotus Notes Domino Server 4.6 Synopsis: Lotus Domino Server is an integrated messaging and web application server. An attacker can crash the Lotus Notes Domino server and stop e-mail and other services that Domino provides for an organization. Description: There is an overflow problem in the Notes LDAP Service (NLDAP); the service that handles the LDAP protocol. This overflow is related to the way that NLDAP handles the ldap_search request. By sending a large amount of data to the parameter in the ldap_search request, an attacker can cause a PANIC in the Domino Server. This will allow an attacker to stop all Domino services running on the affected machine. Affected Versions: Lotus Notes Domino server 4.6. Recommended Action: Upgrade to Maintenance release 4.6.6 or 5.0. Additional Information: Information in this advisory was obtained by the research of Caleb Sima <csima@iss.net> of the ISS X-Force. ISS X-Force would like to thank Lotus Development Corporation for their response and handling of this vulnerability. ________ About ISS: ISS leads the market as the source for e-business risk management solutions, serving as a trusted security provider to thousands of organizations including 21 of the 25 largest U.S. commercial banks and more than 35 government agencies. With its Adaptive Security Management approach, ISS empowers organizations to measure and manage enterprise security risks within Intranet, extranet and electronic commerce environments. Its award-winning SAFEsuite(r) product line of intrusion detection, vulnerability management and decision support solutions are vital for protection in today's world of global connectivity, enabling organizations to proactively monitor, detect and respond to security risks. Founded in 1994, ISS is headquartered in Atlanta, GA with additional offices throughout the U.S. and international operations in Australia/New Zealand, Belgium, France, Germany, Japan, Latin America and the UK. For more information, visit the ISS Web site at www.iss.net or call 800-776-2362. Copyright (c) 1999 by Internet Security Systems, Inc. Permission is hereby granted for the redistribution of this Alert electronically. It is not to be edited in any way without express consent of the X-Force. If you wish to reprint the whole or any part of this Alert in any other medium excluding electronic medium, please e-mail xforce@iss.net for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. X-Force PGP Key available at: http://xforce.iss.net/sensitive.php3 as well as on MIT's PGP key server and PGP.com's key server. Please send suggestions, updates, and comments to: X-Force xforce@iss.net of Internet Security Systems, Inc. - -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: noconv iQCVAwUBN8Fq9TRfJiV99eG9AQGpnQQApezXx1SUYHwh6jAUgrLOSrLxZiqL+lCV JzJUSorex9KgFkMcoULmyhODfRsjT1/aXdKDdG9HBCZVvx9B8JD/3tdCvgdXaEle LVzYThA4Jv/1UqbiU5mTrhdL+zdL7G8qVfnvNQOIMoNCbGM00eklqg+qU67oVQbr hj+RGl8jSMo= =auLB - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to use any or all of this information is the responsibility of each user or organisation, and should be done so in accordance with site policies and procedures. NOTE: This is only the original release of the security bulletin. It will not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the original authors to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/Information/advisories.html If you believe that your system has been compromised, contact AusCERT or your representative in FIRST (Forum of Incident Response and Security Teams). Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for emergencies. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key iQCVAwUBN+dv9ih9+71yA2DNAQHd/gQAiHaxmQVD7Jpm1DzIjfwlzxhYI06gpMQ1 WBlZ5AdqaDc/5hB/+0UTXM17HVFykoSLl4bBqhq8Ozv1CePI8pjnRCbDZ+b42dHO 9jkiSGDv+7z8cpm2MjpzdZ/TL+c0UwxFo44O7Gjhxjvl2vvj2+fPbPwPqCdI4DAt ZTbqXrah1v8= =xSPo -----END PGP SIGNATURE-----