Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT Security Bulletin ASB-2011.0042.2 A number of vulnerabilities have been identified in IBM Lotus Notes 1 June 2011 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: IBM Lotus Notes 6.0 IBM Lotus Notes 6.5 IBM Lotus Notes 7.0 IBM Lotus Notes 8.0 IBM Lotus Notes 8.5 Operating System: Windows Mac OS X Linux variants Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction Denial of Service -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2011-1512 CVE-2011-1218 CVE-2011-1217 CVE-2011-1216 CVE-2011-1215 CVE-2011-1214 CVE-2011-1213 Member content until: Friday, June 24 2011 Revision History: June 1 2011: Added CVE references May 25 2011: Initial Release OVERVIEW A number of vulnerabilities have been identified in IBM Lotus Notes. IMPACT The vendor has provided the following details regarding these vulnerabilities: "In specific situations, arbitrary code could potentially be executed when the following types of attachments are viewed in Notes: LZH archive RTF document Applix Spreadsheets Microsoft Excel document Microsoft Office document Lotus Notes .prz file Lotus Notes .zip file To exploit these vulnerabilities, an attacker would have to send a specially crafted file attachment to users, and then users would have to double-click the attachment and select "View". The specific issues vary depending on attachment type; however, they are all related in how the buffer overflow denial-of-service could be accomplished. In all cases, the issues involve viewing a malicious attachment from a Notes client on a Windows-based machine. Domino servers are not impacted." [1] MITIGATION The vendor recommends applying the relevant fix packs to correct these issues. [1] REFERENCES [1] (May 2011) Fixes for potential security vulnerabilities in Lotus Notes file viewers http://www-01.ibm.com/support/docview.wss?uid=swg21500034&myns=swglotus&mynp=OCSSKTWP&mync=E AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iD8DBQFN5cdD/iFOrG6YcBERAkHaAKCE+bhSz0Q/aY3DelkBfGPbtPI4zgCeLWWn j3tNeoKL1EZPobFjJqWtg0Y= =LjFi -----END PGP SIGNATURE-----