[NEWS] IBM Lotus Domino Server Web Service DoS Vulnerability
From: SecuriTeam (support_at_securiteam.com)
To: firstname.lastname@example.org Date: 7 Apr 2005 10:06:09 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
IBM Lotus Domino Server Web Service DoS Vulnerability
IBM Lotus Domino Server software "provides messaging, calendaring and
scheduling capabilities on a variety of operating systems".
Remote exploitation of a denial of service vulnerability in IBM Corp.'s
Lotus Domino Server web service allows attackers to crash the service,
thereby preventing legitimate access.
* Lotus Domino Server version 6.5.1
* Lotus Domino Server version 6.5.3
The problem specifically exists within the module NLSCCSTR.DLL. A
recursive call loop is made continually when parsing the following example
GET /cgi-bin/[xxx] HTTP/1.0
Where [xxx] represents a long string (~330) of UNICODE decimal value 430
characters. The request triggers a stack exhaustion, which during testing
against Lotus Domino Server version 6.5.1 occurred at the following
instruction just prior to a call to NLSCCSTR.ucnv_toUnicode():
6236B82B PUSH ECX
This results in the immediate crash of nHTTP.EXE and is not reported to
the NSERVER terminal. The crash occurs only when the long string is
prefixed with /cgi-bin/, as Lotus Domino Server uses two different
routines when handling requests made to the root directory and cgi-bin.
Examining the call stack at the time of crash reveals the issue. The
procedure NLSCCSTR.6236B080 is recursively called from the instruction at
address NLSCCSTR.6236B73D. A condition that is checked earlier would JMP
over this recursive call:
PROCEDURE NLSCCSTR.6236B080 (Lotus Domino Server 6.5.1)
6236B70D TEST EAX, EAX
+-< 6236B70F JE SHORT NLSCCSTR.6236B77D
| 6236B73D CALL NLSCCSTR.6236B080
+-> 6236B77D MOV EAX, [EBP+20]
Further up the call stack we can find the following originating calls with
While portions of the stack are overwritten with attacker-supplied data,
gaining flow control to execute arbitrary code does not seem possible.
Exploitation of this vulnerability allows unauthenticated remote attackers
to crash the web service, thereby preventing legitimate usage. This attack
requires minimal resources to launch and can be repeated to ensure that an
unpatched computer is unable to recover. A successful attack does not
generate error messages in the NSERVER terminal. However, the nHTTP.exe
process has indeed crashed.
Restarting Domino Server will resume normal functionality.
Employ firewalls, access control lists or other TCP/UDP restriction
mechanisms to limit access to systems and services.
IBM has released technote #1202446 for this issue. The vendor has been
unable to reproduce the issue and has therefore not released any patches.
iDEFENSE Labs testing has shown this product to be vulnerable to the issue
described in this report. Customers should consider upgrading to Lotus
Domino Server version 6.5.3, which iDEFENSE has confirmed as being not
02/07/2005 - Initial vendor notification
02/09/2005 - Initial vendor response
04/06/2005 - Coordinated public disclosure
The information has been provided by
The original article can be found at:
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: email@example.com
In order to subscribe to the mailing list, simply forward this email to: firstname.lastname@example.org
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.