Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:28461
HistorySep 02, 2012 - 12:00 a.m.

IBM Lotus Domino Cross-Site Scripting and HTTP Response Splitting vulnerabilities

2012-09-0200:00:00
vulners.com
23

Hello 3APA3A!

This month (at 15th of August) IBM released the advisory about IBM Lotus Domino Cross-Site Scripting and HTTP Response Splitting vulnerabilities, which I've informed them about in May. This is only the part of all vulnerabilities, which I've found in their software, and they are working to fix other vulnerabilities.

IBM Security Bulletin: Aug-2012 IBM Lotus Domino Web Server Cross-Site Scripting Vulnerabilities
http://www-01.ibm.com/support/docview.wss?uid=swg21608160

CVE IDs: CVE-2012-3301, CVE-2012-3302.

Note, that regardless in title are mentioned only Cross-Site Scripting vulnerabilities, there is also HTTP Response Splitting described in it.


Affected products:

Vulnerable are IBM Lotus Domino 8.5.3 and previous versions. These vulnerabilities will be fixed in Domino 8.5.4.

For fixes, workarounds and mitigations reference to above-mentioned IBM Security Bulletin.

While fixes for all vulnerabilities are planned for inclusion in Domino 8.5.4, workarounds exist for some of them in Domino servers 7.0 and later by enabling a single INI setting (see bellow).


Details:

In the advisory IBM mentioned four vulnerabilities.

  1. IBM Lotus Domino WebMail Cross-Site Scripting.
    CVE ID: CVE-2012-3302

  2. IBM Lotus Domino Help Cross-Site Scripting on HTTP Server.
    CVE ID: CVE-2012-3302

  3. IBM Lotus Domino HTTP Server Response Splitting.
    CVE ID: CVE-2012-3301

  4. IBM Lotus Domino HTTP Server Response Splitting.
    CVE ID: CVE-2012-3301

The first one is in reality 2 XSS holes (in Webmail) and the second one is in reality four XSS holes (in Help). It's just IBM like to put multiple vulnerabilities of the same type into one vulnerability in their advisories. The third one is XSS via HTTP Response Splitting (variation of the fourth vulnerability). IBM put all the holes in their own order, different then I sent them.

Note, that there is inaccuracy in the description of the third vulnerability (concerning browsers vulnerable to this attack). Earlier I've already informed IBM about this inaccuracy and they should fix it.


Workaround:

There is a workaround for all mentioned in the advisory XSS vulnerabilities:

To avoid this attack, administrators can set the following variable on the Domino server NOTES.INI, available in release 7.0 and later:

DominoValidateFramesetSRC=1

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

Related for SECURITYVULNS:DOC:28461