PT-2001-1156 · Ibm · Lotus Notes Client

Published 2001-01-09 · Updated 2024-02-14 · CVE-2000-1117

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lotus Notes Client R5

Description The issue concerns the Extended Control List (ECL) feature of the Java Virtual Machine (JVM) in the affected software. It allows malicious web site operators to determine the existence of files on the client by measuring delays in the execution of the getSystemResource method.

Recommendations For Lotus Notes Client R5, consider restricting access to the getSystemResource method until a fix is available. As a temporary workaround, disabling the ECL feature may help minimize the risk of exploitation.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2000-1117

Affected Products

Lotus Notes Client

References · 4

• 🔥 http://securityfocus.com/bid/1994 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-1117 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2000-11/0341.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1117 · Note