Newsgroup: it.comp.appl.notes-domino
Titolo: [Full-Disclosure] iDEFENSE Security Advisory 06.23.04: Lotus Notes URI Handler Argument Injection Vulnerability

Lotus Notes URI Handler Argument Injection Vulnerability 
iDEFENSE Security Advisory 06.23.04 
www.idefense.com/application/poi/display?id=111&type=vulnerabilities
 
June 23, 2004 
I. BACKGROUND 
Lotus Notes combines enterprise-class messaging, calendaring and 
scheduling capabilities with a robust platform for collaborative 
applications. More information is available at 
http://www.lotus.com/
. 
II. DESCRIPTION 
Remote exploitation of a parameter filtering vulnerability in IBM 
Corp.´s Lotus Notes application allows remote attackers to execute 
arbitrary code. 
Upon installation of Lotus Notes the following registry entry is added: 
HKEY_CLASSES_ROOT\Notes\Shell\Open\Command 
containing the value 
C:\Program Files\lotus\notes\notes.exe %1 
This causes "notes:" URI requests to be opened by the Lotus Notes 
binary, notes.exe, with the URL passed as an argument. The location of 
the Lotus Notes configuration file, notes.ini, can be specified on the 
command line by prefixing it with an equals sign (=). This parameter can 
specify a file path in the form of a UNC network share. The following 
example is a valid and specifies that the notes.exe executable load a 
configuration file from a remote location: 
notes.exe =\\10.0.0.1\notes\notes.ini 
The notes.ini file allows for the specification of the Notes data 
directory. The notes.exe binary utilizes this directory to load some 
dynamic link libraries (DLL). This parameter too can specify a file path 
in the form of a UNC network share. The following sample excerpt from a 
valid notes.ini configuration file specifies that the data directory 
resides at a remote location: 
[Notes] Directory=\\10.0.0.1\\notes 
Due to insufficient character filtering on the argument passed to 
notes.exe from the "notes:" URI request an attacker can force a user to 
start Lotus Notes with a custom notes.ini file that is under the 
attackers control and specifies a custom data directory that is also 
under the attackers control. The attacker can create a malicious DLL 
containing arbitrary code that will be loaded and executed when 
notes.exe is starting up. 
III. ANALYSIS 
Successful exploitation allows remote attackers to execute arbitrary 
code under the privileges of the user that invoked the "notes:" URI 
handler with an affected version of Lotus Notes. The malicious URI can 
be transmitted to a target via e-mail or web and can also be embedded 
within an HTML IMG tag. 
IV. DETECTION 
iDEFENSE has confirmed the existence of this vulnerability against Lotus 
Notes versions 6.0.3 and 6.5. It is suspected that other versions are 
vulnerable as well. 
V. WORKAROUND 
Remove the registry key responsible for creating the "notes:" URI 
handler: 
HKEY_CLASSES_ROOT\Notes\Shell\Open\Command 
VI. VENDOR RESPONSE 
This particular issue has been documented as SPR# KSPR5X6VEA, which is 
fixed in 6.0.4 and 6.5.2. 
The vendor advisory for this issue is available at: 
www-1.ibm.com/support/docview.wss?rs=475/context=SSKTWP&uid=swg21169510
 
VII. CVE INFORMATION 
The Common Vulnerabilities and Exposures (CVE) project has assigned the 
name CAN-2004-0480 to this issue. This is a candidate for inclusion in 
the CVE list (
http://cve.mitre.org
), which standardizes names for 
security problems. 
VIII. DISCLOSURE TIMELINE 
04/21/2004 Exploit acquired by iDEFENSE 
05/05/2004 iDEFENSE clients notified 
05/05/2004 Initial vendor notification 
05/07/2004 Initial vendor response 
06/23/2004 Public disclosure 
IX. CREDIT 
Jouko Pynnönen (
http://iki.fi/jouko
) is credited with this discovery. 
Get paid for vulnerability research 
http://www.idefense.com/poi/teams/vcp.jsp
 
X. LEGAL NOTICES 
Copyright © 2004 iDEFENSE, Inc. 
Permission is granted for the redistribution of this alert 
electronically. It may not be edited in any way without the express 
written consent of iDEFENSE. If you wish to reprint the whole or any 
part of this alert in any other medium other than electronically, please 
email 
custome...@idefense.com
 for permission. 
Disclaimer: The information in the advisory is believed to be accurate 
at the time of publishing based on currently available information. Use 
of the information constitutes acceptance for use in an AS IS condition. 
There are no warranties with regard to this information. Neither the 
author nor the publisher accepts any liability for any direct, indirect, 
or consequential loss or damage arising from use of, or reliance on, 
this information.


CUT
Qualcuno a letto il post e provato la cosa??
Io si ma la chiave in questione non c'č in nessuno dei miei (ancora
per poco) server????
qualcuno sa qualcosa..

 Io si ma la chiave in questione non c'è in nessuno dei miei (ancora



non ho ben capito la vulnerabilita'
la descriveresti?

 wrote in message
news:2kd8g7...@uni-berlin.de...


 
grazie l'ho visto solo oggi
provero'

Fedrico, ma hai letto il posto ??
Parla di Lotus Notes ... non di Lotus Domino
MR

 Parla di Lotus Notes ... non di Lotus Domino
E' ovvio, visto che si parla di aperture di URL "notes:".
--
@ --> Juda of 3AM - juda(strudel)
despammed.com
KP --> E del resto, quel che conta sono i peluche.
PRJ --> struKtura


Si, l'ho letta, ma inizialmente non mi ero accorto che parlava del
client e non del server..... forse è per quello che sui server io non
ho quella chiave...........
comunque, la cosa funziona anche con i server, aprendo il client
locale del server, non puoi fare nulla perchè il server è già in
funzione e non puoi modificare molto.....
ho comunque capito un'altra cosa, se tu hai fatto una precedente
installazione, magari in una dir diversa, che poi hai tolto per
mettere la versione definitiva del server, la chiave punta ad una dir
errata e l'exploit non funziona più.
Domino invece, che tutto sommata non ha bisogno del registry per
funzionare, funziona lo stesso.