PT-2006-2932 · Ibm · Ibm Lotus Notes

Published 2006-04-20 · Updated 2008-09-05 · CVE-2006-1948

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Lotus Notes versions 6.0 through 6.5 before 20060331

Description The issue concerns the AddSenderToAddressBook operation and NameHelper.lss in IBM Lotus Notes. It does not properly store information in the Personal Address Book when multiple messages are checked and a message uses AltFrom, which might allow remote attackers to trick a user into sending e-mail to an unauthorized recipient.

Recommendations For versions 6.0 through 6.5 before 20060331, consider disabling the AddSenderToAddressBook operation until a patch is available to prevent potential exploitation.

Fix

Related Identifiers

CVE-2006-1948

Affected Products

Ibm Lotus Notes

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-1948 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1948 · Note
• http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21232945 · Note
• http://securitytracker.com/id?1015914 · Note