Vulnerabilities > CVE-2014-0892 - Information Exposure vulnerability in IBM Lotus Domino and Lotus Notes

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
ibm
linux
CWE-200
nessus
NVD
Published: 2014-04-23
Updated: 2017-08-29

Summary

IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options, which makes it easier for remote attackers to execute arbitrary code by leveraging the absence of the NX protection mechanism and placing crafted x86 code on the stack, aka SPR KLYH9GGS9W.

Vulnerable Configurations

Part Description Count
Application
Ibm
45
OS
Linux
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

  • NASL familyMisc.
    NASL idDOMINO_8_5_3FP6_IF2.NASL
    descriptionAccording to its banner, the version of IBM Domino (formerly IBM Lotus Domino) on the remote host is 8.5.x prior to 8.5.3 Fix Pack 6 (FP6) Interim Fix 2 (IF2). It is, therefore, more susceptible to exploitation due to the GCC
    last seen2020-06-01
    modified2020-06-02
    plugin id73967
    published2014-05-12
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/73967
    titleIBM Domino 8.5.x < 8.5.3 Fix Pack 6 Interim Fix 2 NX Memory Protection Disabled
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(73967);
  script_version("1.4");
  script_cvs_date("Date: 2018/07/10 14:27:33");

  script_cve_id("CVE-2014-0892");
  script_bugtraq_id(67014);
  script_xref(name:"CERT", value:"350089");

  script_name(english:"IBM Domino 8.5.x < 8.5.3 Fix Pack 6 Interim Fix 2 NX Memory Protection Disabled");
  script_summary(english:"Checks version of IBM Domino");

  script_set_attribute(attribute:"synopsis", value:"The remote server is affected by a buffer overflow vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its banner, the version of IBM Domino (formerly IBM Lotus
Domino) on the remote host is 8.5.x prior to 8.5.3 Fix Pack 6 (FP6)
Interim Fix 2 (IF2). It is, therefore, more susceptible to
exploitation due to the GCC '-z execstack' flag being used during
compilation. This flag disables the memory protection provided by the
No eXecute (NX) bit allowing remote attackers to execute arbitrary
code more easily.

Note that this issue only affects Linux hosts running 32-bit versions
of Domino.");
  # Advisory
  script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg21670264");
  # PSIRT blog post
  # https://www.ibm.com/blogs/psirt/bm-security-bulletin-ibm-notes-domino-fixes-for-multiple-vulnerabilities-cve-2014-0892-and-oracle-java-critical-patch-updates-for-oct-2013-jan-2014/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ffc42f0b");
  script_set_attribute(attribute:"solution", value:"Upgrade to IBM Domino 8.5.3 FP6 IF2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/04/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/04/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/05/12");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:lotus_domino");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");
  script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");

  script_dependencies("domino_installed.nasl", "os_fingerprint.nasl");
  script_require_keys("Domino/Version", "Host/OS", "Settings/ParanoidReport");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

# Only 32-bit Linux hosts are affected and a workaround is available
if (report_paranoia < 2) audit(AUDIT_PARANOID);

os = get_kb_item_or_exit("Host/OS");
if ("Linux" >!< os)
  audit(AUDIT_OS_NOT, "Linux");

app_name = "IBM Domino";
ver = get_kb_item_or_exit("Domino/Version");
port = get_kb_item("Domino/Version_provided_by_port");
if (!port) port = 0;
version = NULL;
fix = NULL;
fix_ver = NULL;
fix_pack = NULL;
hotfix = NULL;

# Ensure sufficient granularity
if (ver !~ "^(\d+\.){1,}\d+.*$") audit(AUDIT_VER_NOT_GRANULAR, app_name, port, ver);

# Only check for 8.0.x and 8.5.x versions
if (ver =~ "^8\.5($|[^0-9])")
{
  fix = "8.5.3 FP 6 IF 2";
  fix_ver = "8.5.3";
  fix_pack = 6;
  hotfix = 382;
}
else audit(AUDIT_LISTEN_NOT_VULN, app_name, port, ver);

# Breakdown the version into components.
version = eregmatch(string:ver, pattern:"^((?:\d+\.){1,}\d+)(?: FP(\d+))?(?: HF(\d+))?$");
if (isnull(version)) audit(AUDIT_UNKNOWN_APP_VER, app_name);

# Use 0 as a placeholder if no FP or HF. Version number itself was
# checked for in the granularity check.
if (!version[2]) version[2] = 0;
else version[2] = int(version[2]);
if (!version[3]) version[3] = 0;
else version[3] = int(version[3]);

# Compare current to fix and report as needed.
if (
  ver_compare(ver:version[1], fix:fix_ver, strict:FALSE) == -1 ||
  (ver_compare(ver:version[1], fix:fix_ver, strict:FALSE) == 0  && version[2] < fix_pack) ||
  (ver_compare(ver:version[1], fix:fix_ver, strict:FALSE) == 0  && version[2] == fix_pack && version[3] < hotfix)
)
{
  if (report_verbosity > 0)
  {
    report =
      '\n' +
      '\n  Installed version : ' + ver +
      '\n  Fixed version     : ' + fix +
      '\n';
    security_warning(port:port, extra:report);
  }
  else security_warning(port:port);
}
else audit(AUDIT_LISTEN_NOT_VULN, app_name, port, ver);
  • NASL familyMisc.
    NASL idDOMINO_9_0_1_FP1.NASL
    descriptionAccording to its version, the IBM Domino (formerly IBM Lotus Domino) on the remote host is 9.x prior to 9.0.1 Fix Pack 1 (FP1). It is, therefore, affected by the following vulnerabilities : - A stack overflow issue exists due to the insecure
    last seen2020-06-01
    modified2020-06-02
    plugin id73968
    published2014-05-12
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73968
    titleIBM Domino 9.x < 9.0.1 Fix Pack 1 Multiple Vulnerabilities (uncredentialed check)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(73968);
  script_version("1.6");
  script_cvs_date("Date: 2019/11/26");

  script_cve_id(
    "CVE-2013-0408",
    "CVE-2013-3829",
    "CVE-2013-4002",
    "CVE-2013-4041",
    "CVE-2013-5372",
    "CVE-2013-5375",
    "CVE-2013-5456",
    "CVE-2013-5457",
    "CVE-2013-5458",
    "CVE-2013-5772",
    "CVE-2013-5774",
    "CVE-2013-5776",
    "CVE-2013-5778",
    "CVE-2013-5780",
    "CVE-2013-5782",
    "CVE-2013-5783",
    "CVE-2013-5784",
    "CVE-2013-5787",
    "CVE-2013-5788",
    "CVE-2013-5789",
    "CVE-2013-5790",
    "CVE-2013-5797",
    "CVE-2013-5800",
    "CVE-2013-5801",
    "CVE-2013-5802",
    "CVE-2013-5803",
    "CVE-2013-5804",
    "CVE-2013-5805",
    "CVE-2013-5806",
    "CVE-2013-5809",
    "CVE-2013-5812",
    "CVE-2013-5814",
    "CVE-2013-5817",
    "CVE-2013-5818",
    "CVE-2013-5819",
    "CVE-2013-5820",
    "CVE-2013-5823",
    "CVE-2013-5824",
    "CVE-2013-5825",
    "CVE-2013-5829",
    "CVE-2013-5830",
    "CVE-2013-5831",
    "CVE-2013-5832",
    "CVE-2013-5838",
    "CVE-2013-5840",
    "CVE-2013-5842",
    "CVE-2013-5843",
    "CVE-2013-5848",
    "CVE-2013-5849",
    "CVE-2013-5850",
    "CVE-2013-5851",
    "CVE-2013-5878",
    "CVE-2013-5884",
    "CVE-2013-5887",
    "CVE-2013-5888",
    "CVE-2013-5889",
    "CVE-2013-5893",
    "CVE-2013-5896",
    "CVE-2013-5898",
    "CVE-2013-5899",
    "CVE-2013-5902",
    "CVE-2013-5904",
    "CVE-2013-5907",
    "CVE-2013-5910",
    "CVE-2014-0368",
    "CVE-2014-0373",
    "CVE-2014-0375",
    "CVE-2014-0376",
    "CVE-2014-0387",
    "CVE-2014-0403",
    "CVE-2014-0410",
    "CVE-2014-0411",
    "CVE-2014-0415",
    "CVE-2014-0416",
    "CVE-2014-0417",
    "CVE-2014-0418",
    "CVE-2014-0422",
    "CVE-2014-0423",
    "CVE-2014-0424",
    "CVE-2014-0428",
    "CVE-2014-0892"
  );
  script_bugtraq_id(
    59204,
    61310,
    63082,
    63089,
    63095,
    63098,
    63101,
    63102,
    63103,
    63106,
    63110,
    63111,
    63112,
    63115,
    63118,
    63120,
    63121,
    63122,
    63124,
    63126,
    63128,
    63129,
    63131,
    63133,
    63134,
    63135,
    63137,
    63139,
    63141,
    63142,
    63143,
    63145,
    63146,
    63147,
    63148,
    63149,
    63150,
    63151,
    63152,
    63153,
    63154,
    63155,
    63156,
    63157,
    63158,
    63224,
    63618,
    63619,
    63620,
    63621,
    63622,
    64863,
    64875,
    64882,
    64890,
    64894,
    64899,
    64907,
    64912,
    64914,
    64915,
    64916,
    64917,
    64918,
    64919,
    64920,
    64921,
    64922,
    64923,
    64924,
    64925,
    64926,
    64927,
    64928,
    64930,
    64931,
    64932,
    64933,
    64935,
    64937,
    67014
  );
  script_xref(name:"CERT", value:"350089");

  script_name(english:"IBM Domino 9.x < 9.0.1 Fix Pack 1 Multiple Vulnerabilities (uncredentialed check)");
  script_summary(english:"Checks version of IBM Domino");

  script_set_attribute(attribute:"synopsis", value:
"The remote server is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its version, the IBM Domino (formerly IBM Lotus Domino)
on the remote host is 9.x prior to 9.0.1 Fix Pack 1 (FP1). It is,
therefore, affected by the following vulnerabilities :

  - A stack overflow issue exists due to the insecure
    '-z execstack' flag being used during compilation, which
    could aid remote attackers in executing arbitrary code.
    Note that this issue only affects installs on 32-bit
    hosts running Linux. (CVE-2014-0892)

  - Note that the fixes in the Oracle Java CPUs for
    October 2013 and January 2014 are included in the fixed
    IBM Java release, which is included in the fixed IBM
    Domino release. (CVE-2013-0408, CVE-2013-3829,
    CVE-2013-4002, CVE-2013-4041, CVE-2013-5372,
    CVE-2013-5375, CVE-2013-5456, CVE-2013-5457,
    CVE-2013-5458, CVE-2013-5772, CVE-2013-5774,
    CVE-2013-5776, CVE-2013-5778, CVE-2013-5780,
    CVE-2013-5782, CVE-2013-5783, CVE-2013-5784,
    CVE-2013-5787, CVE-2013-5788, CVE-2013-5789,
    CVE-2013-5790, CVE-2013-5797, CVE-2013-5800,
    CVE-2013-5801, CVE-2013-5802, CVE-2013-5803,
    CVE-2013-5804, CVE-2013-5805, CVE-2013-5806,
    CVE-2013-5809, CVE-2013-5812, CVE-2013-5814,
    CVE-2013-5817, CVE-2013-5818, CVE-2013-5819,
    CVE-2013-5820, CVE-2013-5823, CVE-2013-5824,
    CVE-2013-5825, CVE-2013-5829, CVE-2013-5830,
    CVE-2013-5831, CVE-2013-5832, CVE-2013-5838,
    CVE-2013-5840, CVE-2013-5842, CVE-2013-5843,
    CVE-2013-5848, CVE-2013-5849, CVE-2013-5850,
    CVE-2013-5851, CVE-2013-5878, CVE-2013-5884,
    CVE-2013-5887, CVE-2013-5888, CVE-2013-5889,
    CVE-2013-5893, CVE-2013-5896, CVE-2013-5898,
    CVE-2013-5899, CVE-2013-5902, CVE-2013-5904,
    CVE-2013-5907, CVE-2013-5910, CVE-2014-0368,
    CVE-2014-0373, CVE-2014-0375, CVE-2014-0376,
    CVE-2014-0387, CVE-2014-0403, CVE-2014-0410,
    CVE-2014-0411, CVE-2014-0415, CVE-2014-0416,
    CVE-2014-0417, CVE-2014-0418, CVE-2014-0422,
    CVE-2014-0423, CVE-2014-0424, CVE-2014-0428,
    CVE-2014-0892)");
  script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg21670264");
  # http://www-10.lotus.com/ldd/fixlist.nsf/8d1c0550e6242b69852570c900549a74/ef748be11ac2e99285257ca8006fc091?OpenDocument
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?77cf0990");
  # https://www.ibm.com/blogs/psirt/bm-security-bulletin-ibm-notes-domino-fixes-for-multiple-vulnerabilities-cve-2014-0892-and-oracle-java-critical-patch-updates-for-oct-2013-jan-2014/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ffc42f0b");
  script_set_attribute(attribute:"solution", value:
"Upgrade to IBM Domino 9.0.1 FP 1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-0428");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/10/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/04/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/05/12");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:lotus_domino");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("domino_installed.nasl");
  script_require_keys("Domino/Version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

# Check the version of Domino installed.
app_name = "IBM Domino";
ver = get_kb_item_or_exit("Domino/Version");
port = get_kb_item("Domino/Version_provided_by_port");
if (!port) port = 0;
version = NULL;
fix = NULL;
fix_ver = NULL;
fix_pack = NULL;
hotfix = NULL;

# Ensure sufficient granularity.
if (ver !~ "^(\d+\.){1,}\d+.*$") audit(AUDIT_VER_NOT_GRANULAR, app_name, port, ver);

# Only check for 9.0.x
if (ver =~ "^9\.0($|[^0-9])")
{
  fix = "9.0.1 FP1";
  fix_ver = "9.0.1";
  fix_pack = 1;
}
else audit(AUDIT_LISTEN_NOT_VULN, app_name, port, ver);

# Breakdown the version into components.
version = eregmatch(string:ver, pattern:"^((?:\d+\.){1,}\d+)(?: FP(\d+))?$");
if (isnull(version)) audit(AUDIT_UNKNOWN_APP_VER, app_name);

# Use 0 if no FP number. Version number itself was
# checked for in the granularity check.
if (!version[2]) version[2] = 0;
else version[2] = int(version[2]);

# Compare current to fix and report as needed.
if (
  ver_compare(ver:version[1], fix:fix_ver, strict:FALSE) < 1 &&
  version[2] < fix_pack
)
{
  if (report_verbosity > 0)
  {
    report =
      '\n' +
      '\n  Installed version : ' + ver +
      '\n  Fixed version     : ' + fix +
      '\n';
    security_hole(port:port, extra:report);
  }
  else security_hole(port:port);
}
else audit(AUDIT_LISTEN_NOT_VULN, app_name, port, ver);
  • NASL familyWindows
    NASL idLOTUS_NOTES_9_0_1_FP1.NASL
    descriptionThe remote host has a version of IBM Notes (formerly Lotus Notes) 8.0.x / 8.5.x / 9.0.x that is bundled with an IBM Java version prior to 1.6 SR15 FP1. It is, therefore, affected by the vulnerabilities mentioned in the Oracle Java Critical Patch Update advisories for October 2013 and January 2014.
    last seen2020-06-01
    modified2020-06-02
    plugin id73970
    published2014-05-12
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73970
    titleIBM Notes 8.0.x / 8.5.x / 9.0.x with IBM Java < 1.6 SR15 FP1 Multiple Vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(73970);
  script_version("1.5");
  script_cvs_date("Date: 2019/11/26");

  script_cve_id(
    "CVE-2013-0408",
    "CVE-2013-3829",
    "CVE-2013-4002",
    "CVE-2013-4041",
    "CVE-2013-5372",
    "CVE-2013-5375",
    "CVE-2013-5456",
    "CVE-2013-5457",
    "CVE-2013-5458",
    "CVE-2013-5772",
    "CVE-2013-5774",
    "CVE-2013-5776",
    "CVE-2013-5778",
    "CVE-2013-5780",
    "CVE-2013-5782",
    "CVE-2013-5783",
    "CVE-2013-5784",
    "CVE-2013-5787",
    "CVE-2013-5788",
    "CVE-2013-5789",
    "CVE-2013-5790",
    "CVE-2013-5797",
    "CVE-2013-5800",
    "CVE-2013-5801",
    "CVE-2013-5802",
    "CVE-2013-5803",
    "CVE-2013-5804",
    "CVE-2013-5805",
    "CVE-2013-5806",
    "CVE-2013-5809",
    "CVE-2013-5812",
    "CVE-2013-5814",
    "CVE-2013-5817",
    "CVE-2013-5818",
    "CVE-2013-5819",
    "CVE-2013-5820",
    "CVE-2013-5823",
    "CVE-2013-5824",
    "CVE-2013-5825",
    "CVE-2013-5829",
    "CVE-2013-5830",
    "CVE-2013-5831",
    "CVE-2013-5832",
    "CVE-2013-5838",
    "CVE-2013-5840",
    "CVE-2013-5842",
    "CVE-2013-5843",
    "CVE-2013-5848",
    "CVE-2013-5849",
    "CVE-2013-5850",
    "CVE-2013-5851",
    "CVE-2013-5878",
    "CVE-2013-5884",
    "CVE-2013-5887",
    "CVE-2013-5888",
    "CVE-2013-5889",
    "CVE-2013-5893",
    "CVE-2013-5896",
    "CVE-2013-5898",
    "CVE-2013-5899",
    "CVE-2013-5902",
    "CVE-2013-5904",
    "CVE-2013-5907",
    "CVE-2013-5910",
    "CVE-2014-0368",
    "CVE-2014-0373",
    "CVE-2014-0375",
    "CVE-2014-0376",
    "CVE-2014-0387",
    "CVE-2014-0403",
    "CVE-2014-0410",
    "CVE-2014-0411",
    "CVE-2014-0415",
    "CVE-2014-0416",
    "CVE-2014-0417",
    "CVE-2014-0418",
    "CVE-2014-0422",
    "CVE-2014-0423",
    "CVE-2014-0424",
    "CVE-2014-0428"
  );
  script_bugtraq_id(
    61310,
    63082,
    63089,
    63095,
    63098,
    63101,
    63102,
    63103,
    63106,
    63110,
    63111,
    63112,
    63115,
    63118,
    63120,
    63121,
    63122,
    63124,
    63126,
    63128,
    63129,
    63131,
    63133,
    63134,
    63135,
    63137,
    63139,
    63141,
    63142,
    63143,
    63145,
    63146,
    63147,
    63148,
    63149,
    63150,
    63151,
    63152,
    63153,
    63154,
    63155,
    63156,
    63157,
    63158,
    63224,
    63618,
    63619,
    63620,
    63621,
    63622,
    64863,
    64875,
    64882,
    64890,
    64894,
    64899,
    64907,
    64912,
    64914,
    64915,
    64916,
    64917,
    64918,
    64919,
    64920,
    64921,
    64922,
    64923,
    64924,
    64925,
    64926,
    64927,
    64928,
    64930,
    64931,
    64932,
    64933,
    64935,
    64937
  );

  script_name(english:"IBM Notes 8.0.x / 8.5.x / 9.0.x with IBM Java < 1.6 SR15 FP1 Multiple Vulnerabilities");
  script_summary(english:"Checks the bundled Java version.");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has software installed that is affected by multiple
vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote host has a version of IBM Notes (formerly Lotus Notes)
8.0.x / 8.5.x / 9.0.x that is bundled with an IBM Java version prior
to 1.6 SR15 FP1. It is, therefore, affected by the vulnerabilities
mentioned in the Oracle Java Critical Patch Update advisories for
October 2013 and January 2014.");
  script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg21670264");
  # http://www-10.lotus.com/ldd/fixlist.nsf/8d1c0550e6242b69852570c900549a74/ef748be11ac2e99285257ca8006fc091?OpenDocument
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?77cf0990");
  # https://www.ibm.com/blogs/psirt/bm-security-bulletin-ibm-notes-domino-fixes-for-multiple-vulnerabilities-cve-2014-0892-and-oracle-java-critical-patch-updates-for-oct-2013-jan-2014/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ffc42f0b");
  # http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ac29c174");
  # http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?17c46362");
  script_set_attribute(attribute:"solution", value:
"Upgrade to IBM Notes 9.0.1 FP 1 or later. Alternatively, apply the
JVM patch per the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/10/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/04/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/05/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:lotus_notes");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:java");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("lotus_notes_installed.nasl");
  script_require_keys("SMB/Lotus_Notes/Installed");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

appname = "IBM Notes";
kb_base = "SMB/Lotus_Notes/";

port = get_kb_item('SMB/transport');
if (!port) port = 445;

version  = get_kb_item_or_exit(kb_base + 'Version');
path     = get_kb_item_or_exit(kb_base + 'Path');
ver_ui   = get_kb_item_or_exit(kb_base + 'Version_UI');
java_ver = get_kb_item_or_exit(kb_base + 'Java_Version');

# Fixed jvm.dll version for 1.6 SR15 FP1
java_fix  = '2.4.2.49584';
report_fix = NULL;

# Versions 8.0.x / 8.5.x / 9.0.x affected
if (ver_ui =~ "^8\.[05]($|[^0-9])")   report_fix = '1.6 SR15 FP1 ('+java_fix+')';
else if (ver_ui =~ "^9\.0($|[^0-9])") report_fix = '1.6 SR15 FP1 ('+java_fix+') included in Notes 9.0.1 FP1)';
else audit(AUDIT_INST_PATH_NOT_VULN, appname, ver_ui, path);

if (ver_compare(ver:java_ver, fix:java_fix, strict:FALSE) == -1)
{
  if (report_verbosity > 0)
  {
    report +=
      '\n  Path                    : ' + path +
      '\n  Notes installed version : ' + ver_ui +
      '\n  JVM installed version   : ' + java_ver +
      '\n  JVM fixed version       : ' + report_fix +
      '\n';
    security_hole(port:port, extra:report);
  }
  else security_hole(port);
  exit(0);
}
else audit(AUDIT_INST_PATH_NOT_VULN, "IBM Notes' Java Virtual Machine", java_ver, path);
  • NASL familyWindows
    NASL idLOTUS_DOMINO_9_0_1_FP1.NASL
    descriptionThe remote host has a version of IBM Domino (formerly Lotus Domino) 8.0.x / 8.5.x / 9.0.x that is bundled with an IBM Java version prior to 1.6 SR15 FP1. It is, therefore, affected by the vulnerabilities mentioned in the Oracle Java Critical Patch Update advisories for October 2013 and January 2014.
    last seen2020-06-01
    modified2020-06-02
    plugin id73969
    published2014-05-12
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73969
    titleIBM Domino 8.0.x / 8.5.x / 9.0.x with IBM Java < 1.6 SR15 FP1 Multiple Vulnerabilities (credentialed check)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(73969);
  script_version("1.5");
  script_cvs_date("Date: 2019/11/26");

  script_cve_id(
    "CVE-2013-0408",
    "CVE-2013-3829",
    "CVE-2013-4002",
    "CVE-2013-4041",
    "CVE-2013-5372",
    "CVE-2013-5375",
    "CVE-2013-5456",
    "CVE-2013-5457",
    "CVE-2013-5458",
    "CVE-2013-5772",
    "CVE-2013-5774",
    "CVE-2013-5776",
    "CVE-2013-5778",
    "CVE-2013-5780",
    "CVE-2013-5782",
    "CVE-2013-5783",
    "CVE-2013-5784",
    "CVE-2013-5787",
    "CVE-2013-5788",
    "CVE-2013-5789",
    "CVE-2013-5790",
    "CVE-2013-5797",
    "CVE-2013-5800",
    "CVE-2013-5801",
    "CVE-2013-5802",
    "CVE-2013-5803",
    "CVE-2013-5804",
    "CVE-2013-5805",
    "CVE-2013-5806",
    "CVE-2013-5809",
    "CVE-2013-5812",
    "CVE-2013-5814",
    "CVE-2013-5817",
    "CVE-2013-5818",
    "CVE-2013-5819",
    "CVE-2013-5820",
    "CVE-2013-5823",
    "CVE-2013-5824",
    "CVE-2013-5825",
    "CVE-2013-5829",
    "CVE-2013-5830",
    "CVE-2013-5831",
    "CVE-2013-5832",
    "CVE-2013-5838",
    "CVE-2013-5840",
    "CVE-2013-5842",
    "CVE-2013-5843",
    "CVE-2013-5848",
    "CVE-2013-5849",
    "CVE-2013-5850",
    "CVE-2013-5851",
    "CVE-2013-5878",
    "CVE-2013-5884",
    "CVE-2013-5887",
    "CVE-2013-5888",
    "CVE-2013-5889",
    "CVE-2013-5893",
    "CVE-2013-5896",
    "CVE-2013-5898",
    "CVE-2013-5899",
    "CVE-2013-5902",
    "CVE-2013-5904",
    "CVE-2013-5907",
    "CVE-2013-5910",
    "CVE-2014-0368",
    "CVE-2014-0373",
    "CVE-2014-0375",
    "CVE-2014-0376",
    "CVE-2014-0387",
    "CVE-2014-0403",
    "CVE-2014-0410",
    "CVE-2014-0411",
    "CVE-2014-0415",
    "CVE-2014-0416",
    "CVE-2014-0417",
    "CVE-2014-0418",
    "CVE-2014-0422",
    "CVE-2014-0423",
    "CVE-2014-0424",
    "CVE-2014-0428"
  );
  script_bugtraq_id(
    61310,
    63082,
    63089,
    63095,
    63098,
    63101,
    63102,
    63103,
    63106,
    63110,
    63111,
    63112,
    63115,
    63118,
    63120,
    63121,
    63122,
    63124,
    63126,
    63128,
    63129,
    63131,
    63133,
    63134,
    63135,
    63137,
    63139,
    63141,
    63142,
    63143,
    63145,
    63146,
    63147,
    63148,
    63149,
    63150,
    63151,
    63152,
    63153,
    63154,
    63155,
    63156,
    63157,
    63158,
    63224,
    63618,
    63619,
    63620,
    63621,
    63622,
    64863,
    64875,
    64882,
    64890,
    64894,
    64899,
    64907,
    64912,
    64914,
    64915,
    64916,
    64917,
    64918,
    64919,
    64920,
    64921,
    64922,
    64923,
    64924,
    64925,
    64926,
    64927,
    64928,
    64930,
    64931,
    64932,
    64933,
    64935,
    64937
  );

  script_name(english:"IBM Domino 8.0.x / 8.5.x / 9.0.x with IBM Java < 1.6 SR15 FP1 Multiple Vulnerabilities (credentialed check)");
  script_summary(english:"Checks the bundled Java version.");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has software installed that is affected by multiple
vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote host has a version of IBM Domino (formerly Lotus Domino)
8.0.x / 8.5.x / 9.0.x that is bundled with an IBM Java version prior
to 1.6 SR15 FP1. It is, therefore, affected by the vulnerabilities
mentioned in the Oracle Java Critical Patch Update advisories for
October 2013 and January 2014.");
  script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg21670264");
  # http://www-10.lotus.com/ldd/fixlist.nsf/8d1c0550e6242b69852570c900549a74/ef748be11ac2e99285257ca8006fc091?OpenDocument
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?77cf0990");
  # https://www.ibm.com/blogs/psirt/bm-security-bulletin-ibm-notes-domino-fixes-for-multiple-vulnerabilities-cve-2014-0892-and-oracle-java-critical-patch-updates-for-oct-2013-jan-2014/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ffc42f0b");
  # http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ac29c174");
  # http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?17c46362");
  script_set_attribute(attribute:"solution", value:
"Upgrade to IBM Domino 9.0.1 FP 1 or later. Alternatively, apply the
JVM patch per the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/10/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/04/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/05/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:lotus_domino");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:java");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("lotus_domino_installed.nasl");
  script_require_keys("SMB/Domino/Installed");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

appname = "IBM Domino";
kb_base = "SMB/Domino/";

port = get_kb_item('SMB/transport');
if (isnull(port)) port = 445;

domino_ver = get_kb_item_or_exit(kb_base + 'Version');
java_ver   = get_kb_item_or_exit(kb_base + 'Java_Version');
path       = get_kb_item_or_exit(kb_base + 'Path');

# Fixed jvm.dll version for 1.6 SR15 FP1
java_fix   = '2.4.2.49584';
report_fix = NULL;

# Versions 8.0.x / 8.5.x / 9.0.x affected
if (domino_ver =~ "^8\.[05]($|[^0-9])")   report_fix = '1.6 SR15 FP1 ('+java_fix+')';
else if (domino_ver =~ "^9\.0($|[^0-9])") report_fix = '1.6 SR15 FP1 ('+java_fix+') included in Domino 9.0.1 FP1)';
else audit(AUDIT_INST_PATH_NOT_VULN, appname, domino_ver, path);

if (ver_compare(ver:java_ver, fix:java_fix, strict:FALSE) == -1)
{
  if (report_verbosity > 0)
  {
    report =
      '\n  Path                     : ' + path +
      '\n  Domino installed version : ' + domino_ver +
      '\n  JVM installed version    : ' + java_ver +
      '\n  JVM fixed version        : ' + report_fix +
      '\n';
    security_hole(port:port, extra:report);
  }
  else security_hole(port);
  exit(0);
}
else audit(AUDIT_INST_PATH_NOT_VULN, "IBM Domino's Java Virtual Machine", java_ver, path);

References