IBM=20Lotus=20Domino=207=20tunekrnl=20Multiple=20V ulnerabilities

iDefense=20Security=20Advisory=2011.08.06
http://labs.idefense.com/intelligence/vulnerabilities/
Nov=2008,=202006

I.=20BACKGROUND

IBM=20Lotus=20Domino=20is=20a=20software=20suite=2 0designed=20to=20facilit=
ate=20collaboration
between=20co-workers.=20=20More=20information=20can=20be=20foun d=20at
http://www.ibm.com/domino/.

II.=20DESCRIPTION

Local=20exploitation=20of=20multiple=20buffer=20ov erflow=20vulnerabilities=
=20in=20IBM's
Lotus=20Domino=20could=20allow=20an=20attacker=20t o=20elevate=20privileges=
=20to=20root.

The=20'tunekrnl'=20binary=20is=20used=20to=20set=2 0Linux/proc=20sysctl=20s=
ettings,=20allowing
Domino=20to=20increase=20the=20resource=20limits=2 0of=20the=20running=20ke=
rnel.=20=20It=20is
shipped=20with=20the=20owner=20set=20to=20root=20a nd=20the=20set-user-id=20=
bit=20on.=20=20Since=20the
length=20of=20input=20is=20improperly=20validated= 20when=20copying=20to=20=
fixed-size
buffers,=20buffer=20overflow=20can=20occur.

III.=20ANALYSIS

Exploitation=20could=20allow=20local=20attackers=2 0to=20elevate=20their=20=
privileges=20to
that=20of=20the=20'root'=20account.=20On=20most=20 modern=20systems,=20this=
=20means=20that
attackers=20would=20gain=20complete=20control=20ov er=20the=20target=20syst=
em.

IV.=20DETECTION

iDefense=20has=20confirmed=20the=20existence=20of= 20this=20vulnerability=20=
in=20version
7.0.1.1=20of=20IBM's=20Lotus=20Domino=20for=20Linu x.=20Earlier=20versions=20=
may=20also=20be
vulnerable.

V.=20WORKAROUND

To=20prevent=20exploitation,=20rename=20or=20delet e=20the=20/etc/SuSE-rele=
ase=20or
/etc/redhat-release=20file.=20The=20'tunekrnl'=20binary's=20vu lnerable=20c=
ode=20is=20not
executed=20if=20this=20file=20does=20not=20exist.= 20Also,=20removing=20the=
=20set-user-id=20bit
from=20the=20'tunekrnl'=20binary=20prevents=20priv ilege=20escalation.=20Ho=
wever,=20this=20may
require=20running=20the=20utility=20as=20root=20ma nually=20to=20increase=20=
system=20resource
limits=20as=20needed.

VI.=20VENDOR=20RESPONSE

IBM=20Lotus=20has=20addressed=20this=20problem=20w ithin=20Domino=20version=
s=206.5.5=20FP2=20and
7.0.2.=20=20More=20information=20is=20available=20 in=20IBM=20Technote=20#1=
249173=20at
http://www-1.ibm.com/support/docview...=3Dswg21249173.

VII.=20CVE=20INFORMATION

A=20Mitre=20Corp.=20Common=20Vulnerabilities=20and =20Exposures=20(CVE)=20n=
umber=20has=20not
been=20assigned=20yet.

VIII.=20DISCLOSURE=20TIMELINE

08/15/2006=20=20Initial=20vendor=20notification
08/15/2006=20=20Initial=20vendor=20response
11/08/2006=20=20Coordinated=20public=20disclosure

IX.=20CREDIT

This=20vulnerability=20was=20reported=20to=20iDefe nse=20by=20Andrew=20Chri=
stensen=20of
FortConsult=20ApS.

Get=20paid=20for=20vulnerability=20research
http://labs.idefense.com/methodology...bility/vcp.php

Free=20tools,=20research=20and=20upcoming=20events
http://labs.idefense.com/

X.=20LEGAL=20NOTICES

Copyright=20=A9=202006=20iDefense,=20Inc.

Permission=20is=20granted=20for=20the=20redistribu tion=20of=20this=20alert=
=20electronically.
It=20may=20not=20be=20edited=20in=20any=20way=20wi thout=20the=20express=20=
written=20consent=20of
iDefense.=20If=20you=20wish=20to=20reprint=20the=2 0whole=20or=20any=20part=
=20of=20this=20alert=20in
any=20other=20medium=20other=20than=20electronical ly,=20please=20e-mail
customerservice@idefense.com=20for=20permission.

Disclaimer:=20The=20information=20in=20the=20advis ory=20is=20believed=20to=
=20be=20accurate=20at
the=20time=20of=20publishing=20based=20on=20curren tly=20available=20inform=
ation.=20Use=20of
the=20information=20constitutes=20acceptance=20for =20use=20in=20an=20AS=20=
IS=20condition.
There=20are=20no=20warranties=20with=20regard=20to =20this=20information.=20=
Neither=20the
author=20nor=20the=20publisher=20accepts=20any=20l iability=20for=20any=20d=
irect,=20indirect,
or=20consequential=20loss=20or=20damage=20arising= 20from=20use=20of,=20or=20=
reliance=20on,=20this
information.

_______________________________________________
To=20unsubscribe,=20go=20here:
http://www.idefense.com/mailman/list...abs-advisories

__________________________________________________ ______________________
This=20e-mail=20has=20been=20scanned=20for=20all=20viruses= 20by=20Star.=20=
The
service=20is=20powered=20by=20MessageLabs.=20For=2 0more=20information=20on=
=20a=20proactive
anti-virus=20service=20working=20around=20the=20clock,= 20around=20the=20gl=
obe,=20visit:
http://www.star.net.uk
__________________________________________________ ______________________

__________________________________________________ ____________________
This=20email=20has=20been=20scanned=20by=20the=20M essageLabs=20Email=20Sec=
urity=20System.
For=20more=20information=20please=20visit=20http://www.messagelabs.com/ema=
il=20
__________________________________________________ ____________________