PT-2002-1173 · Ibm · Lotus Domino

Published 2002-03-07 · Updated 2017-07-11 · CVE-2002-0086

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lotus Domino versions 5.0.4 through 5.0.7

Description A buffer overflow issue exists in the bindsock component of Lotus Domino on Linux, allowing local users to escalate privileges to root. This can be achieved by manipulating either the Notes ExecDirectory or PATH environment variables to be excessively long.

Recommendations For Lotus Domino version 5.0.4, update to a version that addresses this issue. For Lotus Domino version 5.0.7, update to a version that addresses this issue. As a temporary workaround, consider restricting the length of the Notes ExecDirectory and PATH environment variables to prevent exploitation.

Fix

Related Identifiers

CVE-2002-0086

Affected Products

Lotus Domino

References · 10

• http://esecurityonline.com/advisories/eSO4126.asp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0086 · Security Note
• http://esecurityonline.com/advisories/eSO4124.asp · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8585 · Note
• http://securityfocus.com/bid/4317 · Note
• http://www-1.ibm.com/support/docview.wss?uid=swg21095569 · Note
• http://www-1.ibm.com/support/docview.wss?uid=swg21100441 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8583 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0086 · Note
• http://securityfocus.com/bid/4319 · Note