PT-2012-3857 · Ibm · Ibm Lotus Notes

Publicado 2012-06-20 · Atualizado 2017-08-29 · CVE-2012-2174

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Lotus Notes versions prior to 8.5.3 FP2

Description The issue concerns a URL handler in IBM Lotus Notes that allows remote attackers to execute arbitrary code via a crafted notes:// URL. This is a result of a command injection vulnerability in the URL handling mechanism.

Recommendations For versions prior to 8.5.3 FP2, update to version 8.5.3 FP2 or later to resolve the issue.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2012-2174

ZDI-12-154

Produtos afetados

Ibm Lotus Notes

Referências · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/notes_handler_cmdinject.rb · Exploit
• 🔥 https://exploit-db.com/exploits/23650 · Exploit
• http://ibm.com/support/docview.wss?uid=swg21598348 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2174 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-12-154 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75320 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2174 · Nota