PT-2002-2746 · Ibm · Lotus Domino Server

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-2025

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Lotus Domino server versions 5.0.9a and earlier

Description The issue allows remote attackers to cause a denial of service by exhausting the number of working threads via a large number of HTTP requests. This can be achieved by sending requests for an MS-DOS device name, or an MS-DOS device name with a large number of characters appended to the device name.

Recommendations For versions 5.0.9a and earlier, consider restricting access to the HTTP request handling mechanism to minimize the risk of exploitation. As a temporary workaround, limit the number of concurrent HTTP requests to prevent thread exhaustion.

Correção

Identificadores relacionados

CVE-2002-2025

Produtos afetados

Lotus Domino Server

Referências · 7

• http://securityfocus.com/bid/4019 · Correção
• http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0037.html · Aviso do Fabricante
• http://securityfocus.com/bid/4020 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2002-2025 · Nota de Segurança
• http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/945e97608fda942a85256b37007905b1?OpenDocument&Highlight=0%2CJCHN547JWV · Nota
• http://securityfocus.com/archive/1/253830 · Nota
• http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/a77f8a5132cce70085256b8000792112?OpenDocument&Highlight=0%2CJCHN4UMKLA · Nota