[UNIX] IBM Lotus Domino 7 tunekrnl Multiple Vulnerabilities



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



IBM Lotus Domino 7 tunekrnl Multiple Vulnerabilities
------------------------------------------------------------------------


SUMMARY

IBM Lotus Domino is "a software suite designed to facilitate collaboration
between co-workers". Local exploitation of multiple buffer overflow
vulnerabilities in IBM's Lotus Domino could allow an attacker to elevate
privileges to root.

DETAILS

Vulnerable Systems:
* IBM Lotus Domino version 7.0.1.1 (Linux)

The 'tunekrnl' binary is used to set Linux/proc sysctl settings, allowing
Domino to increase the resource limits of the running kernel. It is
shipped with the owner set to root and the set-user-id bit on. Since the
length of input is improperly validated when copying to fixed-size
buffers, buffer overflow can occur.

Analysis:
Exploitation could allow local attackers to elevate their privileges to
that of the 'root' account. On most modern systems, this means that
attackers would gain complete control over the target system.

Workaround:
To prevent exploitation, rename or delete the /etc/SuSE-release or
/etc/redhat-release file. The 'tunekrnl' binary's vulnerable code is not
executed if this file does not exist. Also, removing the set-user-id bit
from the 'tunekrnl' binary prevents privilege escalation. However, this
may require running the utility as root manually to increase system
resource limits as needed.

Vendor Response:
IBM Lotus has addressed this problem within Domino versions 6.5.5 FP2 and
7.0.2. More information is available in IBM Technote #1249173 at
<http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21249173>
http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21249173.

Disclosure Timeline:
08/15/2006 - Initial vendor notification
08/15/2006 - Initial vendor response
11/08/2006 - Coordinated public disclosure


ADDITIONAL INFORMATION

The information has been provided by
<mailto:idlabs-advisories@xxxxxxxxxxxx> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=440>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=440



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [NEWS] IBM Lotus Domino iNotes Multiple XSS Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... IBM Lotus Domino iNotes Multiple XSS Vulnerabilities ... potentially allowing arbitrary Javascript execution. ... IBM Lotus Domino Web Access 6.x ...
    (Securiteam)
  • [NT] CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow ... Remote exploitation of multiple buffer overflow vulnerabilities in ... rxsGetSubDirs, rxsGetServerDBPathName, rxsSetServerOptions, rxsDeleteFile, ...
    (Securiteam)
  • [NT] Novell eDirectory Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Novell eDirectory Multiple Vulnerabilities ... Three different vulnerabilities were discovered in Novell's eDirectory ... NCP over IP length Heap Overflow: ...
    (Securiteam)
  • [NEWS] Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities ...
    (Securiteam)
  • [UNIX] Apache HTTPD suEXEC Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apache HTTPD suEXEC Multiple Vulnerabilities ... Local exploitation of multiple vulnerabilities within Apache Software ... Foundation's suexec utility could allow an attacker to execute arbitrary ...
    (Securiteam)