Vulnerability discovered on Lotus Domino server "admin4.nsf"

Hi,

I'm doing an external blackbox PT on a mail server running Lotus
Domino. The server OS is Windows 2000 and web server is Lotus Domino.
It has following ports open:

80 - Lotus Domino httpd
443 - Lotus Domino httpd
1352 - Lotus Domino server
5631 - PCAnywhere

During a manual assessment I discovered "admin4.nsf" on server,
accessible without any sort of authentication. It is suppose to be
the Administrator Request Database. From the name I suppose this
should be something that shouldn't be visible to everyone. I don't
have any experience in Lotus Domino. I read a couple of docs on
Internet but couldn't get the real implication of such a
vulnerability. I'm a little hesitant to perform any actions with the
interface as it might disrupt some activities on the server and client
might not like it.

Is there anybody on the list who could guide me on the implication of
this vulnerability and how to get a proper sense of it. What are the
functionalities of 'admin4.nsf' and what damage could it do if an
un-authenticated user has access to it.

Looking forward to some enlightenment on this topic.

Now I'm going to downlaod a Lotus client and see what I can do with
the other open port "1352", looks like another hole from where I can
find my way in.

Thank you.

------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security?
As attacks through web applications continue to rise, you need to proactively
protect your applications from hackers. Cenzic has the most comprehensive
solutions to meet your application security penetration testing and
vulnerability management needs. You have an option to go with a managed
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm).
Download FREE whitepaper on how a managed service can help you:
http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@xxxxxxxxxx
------------------------------------------------------------------------------

Relevant Pages

  • [NEWS] Lotus Domino DoS (Message Loop)
    ... Lotus Domino DoS (Message Loop) ... When a message is sent to a Lotus Domino server with an envelope similar ... There is a row of tabs on the top; ...
    (Securiteam)
  • [NT] Lotus Domino Physical Path Revealed
    ... Due to problems handling Windows DOS devices, the Domino Server can be ... - Lotus Domino version 5.0.9a on Windows 2000 Server ... The vendor was contacted on 7 February, ...
    (Securiteam)
  • Denial of Service in Lotus Domino 5.08 and earlier HTTP Server
    ... Denial of Service in Lotus Domino 5.08 and earlier HTTP Server ... There exists a DOS in the current version of Lotus Domino 5.08 and earlier. ...
    (Bugtraq)
  • Lotus Domino DoS
    ... Some oddly formed mail envelopes can cause Lotus Domino to ... enter a mail routing loop and consume 100% CPU. ... where domain.com is not local to the server in question, ... the server attempts to bounce the message, ...
    (Bugtraq)
  • Re: Vulnerability discovered on Lotus Domino server "admin4.nsf"
    ... Look also the latest vulnerabilities discovered in Lotus Domino: ... There's one very recent vulnerability there reltated to the authentication ... server itself. ...
    (Pen-Test)