PT-2005-3340 · Ibm · Lotus Domino

Leandro Meiners · Publicado 2005-08-03 · Atualizado 2017-09-10 · CVE-2005-2428

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lotus Domino versions R5 and R6

Description The issue allows remote attackers to obtain sensitive information by reading the HTML source. This includes the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, the client platform in the ClntPltfrm field, the client machine name in the ClntMachine field, and the client Lotus Domino release in the ClntBld field. This occurs when "Generate HTML for all fields" is enabled in Lotus Domino R5 and R6 WebMail.

Recommendations For Lotus Domino versions R5 and R6, disable the "Generate HTML for all fields" option to prevent sensitive data from being stored in hidden form fields.

Exploit

Correção

Identificadores relacionados

CVE-2005-2428

Produtos afetados

Lotus Domino

Referências · 14

• 🔥 https://github.com/schwankner/CVE-2005-2428-IBM-Lotus-Domino-R8-Password-Hash-Extraction-Exploit · Exploit
• 🔥 https://exploit-db.com/exploits/3302 · Exploit
• 🔥 https://exploit-db.com/exploits/39495 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21556 · Nota
• http://securityfocus.com/bid/14389 · Nota
• http://www-1.ibm.com/support/docview.wss?uid=swg21212934 · Aviso do Fabricante
• http://securiteam.com/securitynews/5FP0E15GLQ.html · Nota
• http://secunia.com/advisories/16231 · Aviso do Fabricante
• http://cybsec.com/vuln/default_configuration_information_disclosure_lotus_domino.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-2428 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2428 · Nota
• http://securitytracker.com/id?1014584 · Nota
• http://marc.info/?l=bugtraq&m=112240869130356&w=2 · Nota
• http://osvdb.org/18462 · Nota