[UNIX] IBM Lotus Sametime JNILoader Arbitrary DLL Load Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



IBM Lotus Sametime JNILoader Arbitrary DLL Load Vulnerability
------------------------------------------------------------------------


SUMMARY

<http://ibm.com/software/info/lotus/sametime/ > IBM Corp.'s Lotus
Sametime "product provides a real-time online conferencing solution".

Remote exploitation of a input validation vulnerability in IBM Corp.'s
Lotus Sametime allows attackers to execute arbitrary code in the context
of the user viewing a malicious web page.

DETAILS

Vulnerable Systems:
* IBM Corp.'s Lotus Sametime STJNILoader.ocx version 3.1.0.26.
* It is important to note that the Lotus Sametime product does not have
to be installed for a system to be vulnerable. Only the STJNILoader.ocx
must be installed. If it is not installed, the user will be prompted to
install it at the time of exploitation.

The problem specifically exists in the STJNILoader.ocx component of IBM
Corp.'s Lotus Sametime product. This ActiveX control is safe for scripting
and exports a LoadLibrary function that does not properly sanitize input.

This control uses the following class identifiers:
{7261EE42-318E-490A-AE8F-77649DBA1ECA} and
{0B9C9C7D-ED81-4594-AFCB-FC5588125382}

Exploitation allows attackers to execute arbitrary code in the context of
the user viewing a malicious web page.

Varying levels of social engineering are required for successful
exploitation. The attacker must get a malicious library onto the victims
site as well as get them to visit a malicious web site.

Any local file name or valid UNC path can be used as a library to be
loaded. The file extension does not have any affect on whether or not this
control will load the specified library.

Workaround:
Exploitation can easily be mitigated by disabling active content support
within the browser. Take note that employing this workaround could
adversely affect websites that rely upon the execution of browser-based
script code.

Setting the kill-bit for the previously mentioned CLSIDs will prevent this
control from loading within Internet Explorer. Mozilla Firefox does not
contain ActiveX support in it's default configuration.

Vendor Status:
The IBM Lotus Sametime team has addressed this issue by removing the
affected ActiveX control from the current version of their product.
Additionally they have provided hotfixes for older versions. More
information is available from
<http://www-1.ibm.com/support/docview.wss?uid=swg21257029> IBM Technote
swg21257029.

Disclosure Timeline:
* 08/01/2006 - Initial vendor notification
* 08/01/2006 - Initial vendor response
* 03/29/2007 - Coordinated public disclosure


ADDITIONAL INFORMATION

The information has been provided by iDefense.
The original article can be found at:

<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=495>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=495



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages