PT-2007-7424 · Ibm+1 · Ibm Lotus Notes+1

Published 2007-12-28 · Updated 2018-10-15 · CVE-2007-6593

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Autonomy KeyView SDK versions used by IBM Lotus Notes 5.x through 8.x

Description The issue is related to multiple stack-based buffer overflows in the l123sr.dll component of the Autonomy KeyView SDK, which is used by IBM Lotus Notes. This can be exploited by user-assisted remote attackers through the Length and Value fields for certain Types in a Lotus 1-2-3 (.123) file in the Worksheet File (WKS) format. An example of exploitation is a file with a crafted SRANGE record.

Recommendations For IBM Lotus Notes 5.x through 8.x, consider disabling the use of the l123sr.dll component until a patch is available to prevent the exploitation of the buffer overflows in the Length and Value fields for certain Types in Lotus 1-2-3 files.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-6593

Affected Products

Autonomy Keyview Sdk

Ibm Lotus Notes

References · 17

• 🔥 https://exploit-db.com/exploits/30816 · Exploit
• http://secunia.com/advisories/27836 · Vendor Advisory
• http://secunia.com/advisories/27835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6593 · Security Note
• http://secunia.com/advisories/27849 · Vendor Advisory
• http://ibm.com/support/docview.wss?rs=475&uid=swg21285600 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6593 · Note
• http://securitytracker.com/id?1019096 · Note
• http://securityfocus.com/archive/1/484272/100/0/threaded · Note
• http://securitytracker.com/id?1019002 · Note
• http://coresecurity.com/index.php5?action=item&id=2008 · Note
• http://securityfocus.com/bid/26604 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38645 · Note
• http://vupen.com/english/advisories/2007/4020 · Note
• http://securityreason.com/securityalert/3499 · Note