PT-2007-5496 · Ibm · Ibm Lotus Notes

Publicado 2007-08-13 · Atualizado 2008-09-05 · CVE-2007-4309

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Lotus Notes versions 5.x through 7.0.2

Description The issue allows user-assisted remote authenticated administrators to obtain a cleartext notes.id password. This is achieved by setting the notes.ini KFM ShowEntropy and Debug Outfile debug variables.

Recommendations For IBM Lotus Notes versions 5.x through 7.0.2, consider restricting access to the notes.ini file to prevent unauthorized setting of the KFM ShowEntropy and Debug Outfile variables until a fix is available. As a temporary workaround, limit the use of debug variables to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-4309

Produtos afetados

Ibm Lotus Notes

Referências · 5

• http://heise-security.co.uk/news/92958 · Nota
• http://securitytracker.com/id?1018433 · Nota
• http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21266085 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4309 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4309 · Nota