Lotus Domino @SetHTTPHeader Permits HTTP Response Splitting Attacks
|
|
SecurityTracker Alert ID: 1013839
|
|
SecurityTracker URL: http://securitytracker.com/id?1013839
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Apr 29 2005
|
Impact: Modification of system information, Modification of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 6.0.x, 6.5.x; prior to 6.0.5, prior to 6.5.4
|
Description: An input validation vulnerability was reported in Lotus Domino. A local user with certain privileges can conduct HTTP response splitting attacks.
A local user with application installation privileges can create specially crafted code that invokes the @SetHTTPHeader function
to inject arbitrary content into the HTTP header returned by the server. This permits HTTP response splitting attacks. A user
can exploit this to spoof content on the target server, attempt to poison any intermediate web caches, or conduct cross-site scripting
attacks.
The vendor credits Juan C. Calderon with reporting this vulnerability.
The vendor disclosed this vulnerability.
|
Impact: A local user may be able to poison any intermediate web caches with arbitrary content.
|
Solution: The vendor has issued fixed versions (6.0.5, 6.5.4).
The vendor's advisory is available at:
http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21202437
|
Vendor URL: www-1.ibm.com/support/docview.wss?rs=463&uid=swg21202437 (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (NT), Windows (2000)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 29 Apr 2005 01:14:57 -0400
Subject: http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21202437
|
CERT VU#699798 - Lotus Domino allows HTTP header injection
Technote (FAQ)
Problem
Juan C Calderon reported an issue where it is possible for the @SetHTTPHeader function
to be misused to inject content into the header.
The @SetHTTPHeader function is only available to application developers. This
vulnerability requires that the attacker have access to install a rogue application on
the Lotus Domino server in order to execute this code. The impact of the vulnerability,
if exploited, is HTTP response splitting or browser/proxy cache poisoning.
Solution
This issue was reported to Quality Engineering and has been addressed in Domino 6.5.4
and 6.0.5. Customers should upgrade to address this potential vulnerability.
Excerpt from the Lotus Notes and Domino Release 6.5.4 / 6.0.5 MR fix list (available at
http://www.ibm.com/developerworks/lotus):
SPR# KSPR63RRBF - Fixed a potential security issue.
CERT advisories can be found at the following address:
http://www.cert.org
|
|
