PT-2011-2952 · Ibm+1 · Ibm Lotus Notes+1

Published 2011-05-31 · Updated 2017-09-19 · CVE-2011-1213

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Lotus Notes versions prior to 8.5.2 FP3

Description The issue is related to an integer underflow in the lzhsr.dll component of Autonomy KeyView, used in IBM Lotus Notes. This can be exploited by remote attackers via a crafted header in a .lzh attachment, leading to a stack-based buffer overflow and potentially allowing the execution of arbitrary code.

Recommendations For versions prior to 8.5.2 FP3, update to version 8.5.2 FP3 or later to resolve the issue. As a temporary workaround, consider restricting the handling of .lzh attachments to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2011-1213

Affected Products

Autonomy Keyview

Ibm Lotus Notes

References · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/lotusnotes_lzh.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/lotus/lotusnotes_lzh.rb · Exploit
• 🔥 https://exploit-db.com/exploits/17448 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-1213 · Security Note
• http://secunia.com/advisories/44624 · Vendor Advisory
• http://securityfocus.com/bid/47962 · Note
• http://ibm.com/support/docview.wss?uid=swg21500034 · Note
• http://securityreason.com/securityalert/8285 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67620 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1213 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=904 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14634 · Note