-----BEGIN PGP SIGNED MESSAGE----- =============================================================================== Security Advisory CERT-NL =============================================================================== Author/Source : Teun Nijssen Index : S-99-32 Distribution : World Page : 1 Classification: External Version: 1 Subject : Lotus Domino Server 4.6 Date : 01-Sep-99 =============================================================================== By courtesy of CIAC and ISS we received information on a vulnerability in the Lotus Domino Server Lotus Notes Domino Server Denial of Service Attacks ______________________________________________________________________________ PROBLEM: An overflow problem in the Notes LDAP Service (NLDAP). PLATFORM: Lotus Notes Domino Server 4.6. DAMAGE: An attacker could cause a denial of service. SOLUTION: Upgrade to Maintenance release 4.6.6 or 5.0. ______________________________________________________________________________ VULNERABILITY Risk is low because no data is lost and the system security ASSESSMENT: is not breached. ______________________________________________________________________________ Denial of Service Attack against Lotus Notes Domino Server 4.6 Synopsis: Lotus Domino Server is an integrated messaging and web application server. An attacker can crash the Lotus Notes Domino server and stop e-mail and other services that Domino provides for an organization. Description: There is an overflow problem in the Notes LDAP Service (NLDAP); the service that handles the LDAP protocol. This overflow is related to the way that NLDAP handles the ldap_search request. By sending a large amount of data to the parameter in the ldap_search request, an attacker can cause a PANIC in the Domino Server. This will allow an attacker to stop all Domino services running on the affected machine. Affected Versions: Lotus Notes Domino server 4.6. Recommended Action: Upgrade to Maintenance release 4.6.6 or 5.0. Additional Information: Information in this advisory was obtained by the research of Caleb Sima of the ISS X-Force. ISS X-Force would like to thank Lotus Development Corporation for their response and handling of this vulnerability. ________ About ISS: ISS leads the market as the source for e-business risk management solutions, serving as a trusted security provider to thousands of organizations including 21 of the 25 largest U.S. commercial banks and more than 35 government agencies. With its Adaptive Security Management approach, ISS empowers organizations to measure and manage enterprise security risks within Intranet, extranet and electronic commerce environments. Its award-winning SAFEsuite(r) product line of intrusion detection, vulnerability management and decision support solutions are vital for protection in today's world of global connectivity, enabling organizations to proactively monitor, detect and respond to security risks. Founded in 1994, ISS is headquartered in Atlanta, GA with additional offices throughout the U.S. and international operations in Australia/New Zealand, Belgium, France, Germany, Japan, Latin America and the UK. For more information, visit the ISS Web site at www.iss.net or call 800-776-2362. Copyright (c) 1999 by Internet Security Systems, Inc. Permission is hereby granted for the redistribution of this Alert electronically. It is not to be edited in any way without express consent of the X-Force. If you wish to reprint the whole or any part of this Alert in any other medium excluding electronic medium, please e-mail xforce@iss.net for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. X-Force PGP Key available at: http://xforce.iss.net/sensitive.php3 as well as on MIT's PGP key server and PGP.com's key server. Please send suggestions, updates, and comments to: X-Force xforce@iss.net of Internet Security Systems, Inc. ______________________________________________________________________________ CIAC wishes to acknowledge Internet Security Systems, Inc. for the information contained in this bulletin. ============================================================================== CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet is the Dutch network for educational, research and related institutes. CERT-NL is a member of the Forum of Incident Response and Security Teams (FIRST). All CERT-NL material is available under: http://www.surfnet.nl/surfnet/security/cert-nl.html ftp://ftp.surfnet.nl/surfnet/net-security In case of computer or network security problems please contact your local CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer please address the appropriate (local) CERT/security-team). CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer, i.e. UTC+0100 in winter and UTC+0200 in summer (DST). Email: cert-nl@surfnet.nl ATTENDED REGULARLY ALL DAYS Phone: +31 302 305 305 BUSINESS HOURS ONLY Fax: +31 302 305 329 BUSINESS HOURS ONLY Snailmail: SURFnet bv Attn. CERT-NL P.O. Box 19035 NL - 3501 DA UTRECHT The Netherlands NOODGEVALLEN: 06 52 87 92 82 ALTIJD BEREIKBAAR EMERGENCIES : +31 6 52 87 92 82 ATTENDED AT ALL TIMES CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES: THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED* PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.0.2i iQCVAwUBN80qXPE6s6q7Tf4RAQEWsQP+PQvK8D0xSIdjjwJl017Z5of03qS0sOKI 7Vb25aG6kFWD5yqZ6Dbhy54qsnYiOfHZ1/U72ALlBYJR+PejdnrcL8lj6k7du2NE Cs4yq8HwiYHHMScy44yiFVvzejeHaYDYVp3wKyvwnzLEIC7R68/Tl7YwrP/tZsYz 2fGFBm0XJo8= =V7+T -----END PGP SIGNATURE-----