PT-2006-1719 · Ibm · Lotus Domino Inotes Client

Published 2006-02-13 · Updated 2017-07-20 · CVE-2006-0663

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Lotus Domino iNotes Client versions 6.5.4 through 7.0

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various means, including an email subject, an encoded javascript URI (e.g., "java script:"), or an email attachment filename when the Domino Web Access ActiveX control is not installed.

Recommendations For Lotus Domino iNotes Client versions 6.5.4 through 7.0, consider disabling the execution of JavaScript code in email subjects and attachments to minimize the risk of exploitation. Restrict access to email attachments when the Domino Web Access ActiveX control is not installed. Avoid using encoded javascript URIs in emails until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2006-0663

Affected Products

Lotus Domino Inotes Client

References · 15

• 🔥 https://exploit-db.com/exploits/27182 · Exploit
• 🔥 http://securityfocus.com/bid/16577 · Exploit
• 🔥 http://securitytracker.com/id?1015610 · Exploit
• 🔥 https://exploit-db.com/exploits/27181 · Exploit
• http://secunia.com/secunia_research/2005-38/advisory · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229919 · Patch
• http://secunia.com/advisories/16340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0663 · Security Note
• http://osvdb.org/23079 · Patch
• http://osvdb.org/23078 · Patch
• http://vupen.com/english/advisories/2006/0499 · Vendor Advisory
• http://osvdb.org/23077 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24614 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24611 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24613 · Note