====================================================================== Secunia Research 10/02/2006
- IBM Lotus Domino iNotes Client Script Insertion Vulnerabilities - ====================================================================== Table of Contents Affected Software....................................................1 Severity.............................................................2 Description of Vulnerability.........................................3 Solution.............................................................4 Time Table...........................................................5 Credits..............................................................6 References...........................................................7 About Secunia........................................................8 Verification.........................................................9 ====================================================================== 1) Affected Software * IBM Lotus Domino Web Access 7.x * IBM Lotus Domino Web Access (iNotes) 6.x * IBM Lotus Domino 6.x * IBM Lotus Domino 7.x Other versions may also be affected. ====================================================================== 2) Severity Rating: Moderately Critical Impact: Cross-Site Scripting Where: Remote ====================================================================== 3) Description of Vulnerability Secunia Research has discovered some vulnerabilities in Lotus Domino iNotes Client, which can be exploited by malicious people to conduct script insertion attacks. 1) Attached files (e.g. ".html" files) are opened in the context of the site if the user clicks on it. This can be exploited to execute arbitrary JavaScript code in the context of the user's session. The vulnerability has been confirmed in version 6.5.4. The vulnerability does not affect version 6.5.4 FP1. Prior versions may also be affected. 2) The email subject is not properly sanitised before being displayed to the user as the browser title. This can be exploited to execute arbitrary JavaScript in the context of the user's session when the user views a received email. Example: </TITLE><SCRIPT>alert("Vulnerable!");</SCRIPT> The vulnerability has been confirmed in version 6.5.4 and also reported in version 7.0. Other versions may also be affected. 3) It is possible to bypass certain security checks related to "javascript:" URLs by inserting " " in the middle of the URL. This can be exploited to execute arbitrary JavaScript code in the context of the user's session. Example: <a href="java script:alert('Vulnerable!');">Link</a> The vulnerability has been confirmed in version 6.5.4 and also reported in version 7.0. Other versions may also be affected. 4) The attachment filename is not properly sanitised before being displayed to the user. This can be exploited to execute arbitrary JavaScript in context of the user's session when the user views a received email. Successful exploitation requires that the Domino Web Access ActiveX control is not installed on the browser. The vulnerability has been confirmed in version 6.5.4 and also reported in version 7.0. Other versions may also be affected. ====================================================================== 4) Solution Update to version 6.5.5 or 7.0.1. ====================================================================== 5) Time Table 22/08/2005 - Initial vendor notification. 25/08/2005 - Initial vendor response. 10/02/2006 - Public disclosure. ====================================================================== 6) Credits 1-3) Jakob Balle, Secunia Research. 4) Tan Chew Keong, Secunia Research. ====================================================================== 7) References No other references. ====================================================================== 8) About Secunia Secunia collects, validates, assesses, and writes advisories regarding all the latest software vulnerabilities disclosed to the public. These advisories are gathered in a publicly available database at the Secunia website: http://secunia.com/ Secunia offers services to our customers enabling them to receive all relevant vulnerability information to their specific system configuration. Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/secunia_security_advisories/ ====================================================================== 9) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2005-38/advisory/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ======================================================================