Lotus Domino SMTP Vulnerability

Updated 2/21/01
CAN 2000-1046
CVE 2001-0130
CVE 2001-0260

Impact

A remote attacker could cause a denial of service or execute arbitrary commands on the server.

Background

The Lotus Domino family of servers includes an e-mail server which implements the Simple Mail Transfer Protocol (SMTP). It also supports extensions which allow for the use of delivery status notifications, which provide information about the delivery status of an e-mail message to the sender. The ENVID keyword is optionally used by an e-mail client to specify an identifier for an outgoing message. This identifier is then included in any delivery status notifications regarding that message.

Another feature of Lotus Domino mail servers is the policy feature, which can be used to set relaying rules. With this feature, an e-mail administrator can specify the rules which determine when the server may be used for relaying mail from one remote site to another.

The Problems

Malformed HTML attachment processing

2/21/01
CVE 2001-0130
There is a buffer overflow condition which occurs whenever a Lotus Notes client views an HTML attachment containing font size tags which are not properly terminated. This vulnerability could be exploited remotely by sending an e-mail message containing a specially-crafted attachment to the server, and waiting for the recipient to open the attachment using Lotus Notes. Such an attack could cause the server to become unresponsive or could allow the execution of arbitrary code.

Lotus Domino version 5 up through 5.05 is affected by this vulnerability.

Buffer overflow in ENVID

CVE 2000-1047
By sending a very long argument to the ENVID keyword, it is possible to cause a buffer overflow in the mail server. This condition could be exploited by a remote attacker to cause a denial of service or to execute arbitrary code. Lotus Domino version 5 up through 5.04 is affected by this vulnerability.

Buffer overflow in policy feature

CVE 2001-0260
A buffer overflow condition exists in the code which implements the policy feature. This vulnerability could also be used to cause a denial of service or to execute arbitrary commands. Lotus Domino version 5 up through 5.05 is affected by this vulnerability if the policy feature is enabled.

Denial of service in 5.0.2

CAN 2000-1046
A vulnerability could allow an attacker to cause a denial-of-service in Lotus Domino 5.0.2a and 5.0.2c by sending a very long argument to the RCPT TO, SAML FROM, or SOML FROM commands.

Resolution

Upgrade to the latest version of Lotus Domino.

Where can I read more about this?

The malformed HTML attachment vulnerability was discussed in a Symantec bulletin. The ENVID vulnerability was discussed in S.A.F.E.R. Security Bulletin 001103.EXP.1.9. The vulnerability in the policy feature was discussed in S.A.F.E.R. Security Bulletin 010123.EXP.1.10. The denial of service vulnerability affecting Lotus Domino 5.0.2 was posted to Bugtraq.