Security Alert (A15-06-03): Multiple Vulnerabilities in IBM Notes and Domino


 

Published on: 10 June 2015

  
  

Description:

Multiple vulnerabilities are found in IBM Lotus Notes and Domino. The bundled Java virtual machine (JVM) is susceptible to different attacks as listed in the Oracle Critical Patch Update Advisories (April 2015) which could be remotely exploited without authentication.

A remote attacker could exploit the vulnerabilities by enticing a user to open a specially-crafted file or visit a malicious website.

 

Affected Systems:

  • IBM Notes and Domino 9.0.1 Fix Pack 3 (plus Interim Fixes) and earlier
  • IBM Notes and Domino 8.5.3 Fix Pack 6 (plus Interim Fixes) and earlier
  • All 9.0 and 8.5.x releases of IBM Domino prior to those listed above

 

Impact:

Successful exploitation could lead to arbitrary code execution, retrieval of sensitive information and system crash.

 

Recommendation:

The vendor has released fixes to address the issue and they can be downloaded at the following URL:

  • Java patch installer for Notes & Domino 9.0.1 Fix Pack 3 (plus Interim Fix)
    http://www-01.ibm.com/support/docview.wss?uid=swg21657963#5_tab

  • Java patch installer for Notes & Domino 8.5.3 Fix Pack 6 (plus Interim Fix)
    http://www-01.ibm.com/support/docview.wss?uid=swg21663874#JVM_tab

 

More Information:

http://www-01.ibm.com/support/docview.wss?uid=swg21903541
https://www.hkcert.org/my_url/en/alert/15061010
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0192
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0458
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0459
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0469
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0477
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0478
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0480
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0488
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0491
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1914
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1916
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2808
 



Tag: IBM , IBM Notes , Domino
Tags