CVE-2017-1274 - OpenCVE

IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM X-Force ID: 124749.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ibm	Domino

Configuration 1 [-]

OR	cpe:2.3:a:ibm:domino:8.5.3:::::::*
	cpe:2.3:a:ibm:domino:8.5.3.6:::::::*
	cpe:2.3:a:ibm:domino:9.0.0.0:::::::*
	cpe:2.3:a:ibm:domino:9.0.1:::::::*
	cpe:2.3:a:ibm:domino:9.0.1.8:::::::*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/152786/Lotus-Domino-8.5.3-EXAMINE-Stack-Buffer-Overflow.html
http://www.ibm.com/support/docview.wss?uid=swg22002280
http://www.securityfocus.com/bid/97910
http://www.securityfocus.com/bid/98019
http://www.securitytracker.com/id/1038358
https://www.kb.cert.org/vuls/id/676632

History

No history.

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2017-04-25T18:00:00

Updated: 2024-08-05T13:25:17.480Z

Reserved: 2016-11-30T00:00:00

Link: CVE-2017-1274

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-04-25T18:59:00.197

Modified: 2019-05-10T17:29:00.220

Link: CVE-2017-1274

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Domino", "vendor": "IBM", "versions": [{"status": "affected", "version": "8.5.3.5, 8.5.3.6, 9.0.1, 8.5, 9.0, 8.5.1, 8.5.2, 8.5.3, 9.0.1.1, 8.0.2, 8.0, 8.0.1, 8.5.1.5, 8.5.2.4, 9.0.1.2, 8.5.0.1, 9.0.1.3, 8.5.1.4, 9.0.1.4, 9.0.1.5, 8.5.1.1, 9.0.1.6, 9.0.1.7, 9.0.1.8"}]}], "datePublic": "2017-04-20T00:00:00", "descriptions": [{"lang": "en", "value": "IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM X-Force ID: 124749."}], "problemTypes": [{"descriptions": [{"description": "Gain Access", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-05-10T16:06:04", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.ibm.com/support/docview.wss?uid=swg22002280"}, {"name": "97910", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/97910"}, {"name": "98019", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/98019"}, {"name": "1038358", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1038358"}, {"name": "VU#676632", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "https://www.kb.cert.org/vuls/id/676632"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/152786/Lotus-Domino-8.5.3-EXAMINE-Stack-Buffer-Overflow.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "ID": "CVE-2017-1274", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Domino", "version": {"version_data": [{"version_value": "8.5.3.5, 8.5.3.6, 9.0.1, 8.5, 9.0, 8.5.1, 8.5.2, 8.5.3, 9.0.1.1, 8.0.2, 8.0, 8.0.1, 8.5.1.5, 8.5.2.4, 9.0.1.2, 8.5.0.1, 9.0.1.3, 8.5.1.4, 9.0.1.4, 9.0.1.5, 8.5.1.1, 9.0.1.6, 9.0.1.7, 9.0.1.8"}]}}]}, "vendor_name": "IBM"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM X-Force ID: 124749."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Gain Access"}]}]}, "references": {"reference_data": [{"name": "http://www.ibm.com/support/docview.wss?uid=swg22002280", "refsource": "CONFIRM", "url": "http://www.ibm.com/support/docview.wss?uid=swg22002280"}, {"name": "97910", "refsource": "BID", "url": "http://www.securityfocus.com/bid/97910"}, {"name": "98019", "refsource": "BID", "url": "http://www.securityfocus.com/bid/98019"}, {"name": "1038358", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1038358"}, {"name": "VU#676632", "refsource": "CERT-VN", "url": "https://www.kb.cert.org/vuls/id/676632"}, {"name": "http://packetstormsecurity.com/files/152786/Lotus-Domino-8.5.3-EXAMINE-Stack-Buffer-Overflow.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/152786/Lotus-Domino-8.5.3-EXAMINE-Stack-Buffer-Overflow.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T13:25:17.480Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.ibm.com/support/docview.wss?uid=swg22002280"}, {"name": "97910", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/97910"}, {"name": "98019", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/98019"}, {"name": "1038358", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1038358"}, {"name": "VU#676632", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "https://www.kb.cert.org/vuls/id/676632"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/152786/Lotus-Domino-8.5.3-EXAMINE-Stack-Buffer-Overflow.html"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2017-1274", "datePublished": "2017-04-25T18:00:00", "dateReserved": "2016-11-30T00:00:00", "dateUpdated": "2024-08-05T13:25:17.480Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:domino:8.5.3:*:*:*:*:*:*:*", "matchCriteriaId": "091D9954-232A-4158-A516-35A735343121", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:domino:8.5.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "BBAD0259-8096-41CD-BA06-58E26F2821C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:domino:9.0.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "28326C23-64DA-4FA0-9F3D-7660FC17C2E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:domino:9.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "373527AD-D128-41CC-BEBA-6581F22D8AEE", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:domino:9.0.1.8:*:*:*:*:*:*:*", "matchCriteriaId": "9196D34D-14FF-4E78-B9EE-36B59D133A98", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM X-Force ID: 124749."}, {"lang": "es", "value": "IBM Domino versiones 8.5.3 y 9.0 es vulnerable a desbordamiento basado en pila en el servicio IMAP lo que podr\u00eda permitir a un atacante autenticado ejecutar c\u00f3digo arbitrario especificando un nombre largo de buz\u00f3n. IBM X-Force ID: 124749."}], "id": "CVE-2017-1274", "lastModified": "2019-05-10T17:29:00.220", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-04-25T18:59:00.197", "references": [{"source": "psirt@us.ibm.com", "url": "http://packetstormsecurity.com/files/152786/Lotus-Domino-8.5.3-EXAMINE-Stack-Buffer-Overflow.html"}, {"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=swg22002280"}, {"source": "psirt@us.ibm.com", "url": "http://www.securityfocus.com/bid/97910"}, {"source": "psirt@us.ibm.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/98019"}, {"source": "psirt@us.ibm.com", "url": "http://www.securitytracker.com/id/1038358"}, {"source": "psirt@us.ibm.com", "url": "https://www.kb.cert.org/vuls/id/676632"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}