PT-2002-1135 · Ibm · Lotus Domino Server

Published 2002-04-12 · Updated 2008-09-05 · CVE-2002-0037

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Lotus Domino Servers versions 4.5x through 5.x

Description The issue allows attackers to bypass the intended Reader and Author access list for a document's object. This is achieved via a Notes API call, specifically the NSFDbReadObject function, which directly accesses the object, thus circumventing access controls.

Recommendations For Lotus Domino Servers versions 4.5x through 5.x, consider restricting access to the NSFDbReadObject function until a patch is available. Additionally, review and enforce the intended Reader and Author access lists for all documents to minimize potential exploitation.

Fix

Related Identifiers

CVE-2002-0037

Affected Products

Lotus Domino Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-0037 · Security Note
• http://iss.net/security_center/static/10095.php · Note
• http://kb.cert.org/vuls/id/657899 · Note
• http://archives.neohapsis.com/archives/bugtraq/2001-09/0147.html · Note
• http://archives.neohapsis.com/archives/bugtraq/2001-09/0150.html · Note