PT-2002-2746 · Ibm · Lotus Domino Server

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2025

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Lotus Domino server versions 5.0.9a and earlier

Description The issue allows remote attackers to cause a denial of service by exhausting the number of working threads via a large number of HTTP requests. This can be achieved by sending requests for an MS-DOS device name, or an MS-DOS device name with a large number of characters appended to the device name.

Recommendations For versions 5.0.9a and earlier, consider restricting access to the HTTP request handling mechanism to minimize the risk of exploitation. As a temporary workaround, limit the number of concurrent HTTP requests to prevent thread exhaustion.

Fix

Related Identifiers

CVE-2002-2025

Affected Products

Lotus Domino Server

References · 7

• http://securityfocus.com/bid/4019 · Patch
• http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0037.html · Vendor Advisory
• http://securityfocus.com/bid/4020 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2002-2025 · Security Note
• http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/945e97608fda942a85256b37007905b1?OpenDocument&Highlight=0%2CJCHN547JWV · Note
• http://securityfocus.com/archive/1/253830 · Note
• http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/a77f8a5132cce70085256b8000792112?OpenDocument&Highlight=0%2CJCHN4UMKLA · Note