Multiple flaws reported in IBM Lotus Domino products

One flaw can be exploited by attackers to conduct a cross-site scripting or DoS attack, according to security advisories.

An attacker can cause a buffer overflow resulting in a DoS attack if the IMAP server task is enabled on the Domino server, according to a Technote advisory released by IBM.

The issue was fixed in Lotus Domino versions 6.5.6 and 7.0.2, according to IBM. It exists in Lotus Domino Server versions 6.5 and 7.0, according to an advisory released today by TippingPoint’s Zero Day Initiative.

TippingPoint researchers reported the flaw to IBM last August and the vendor has protected its own customers against attacks on the flaw since January.

Meanwhile, VeriSign iDefense released an advisory today explaining a vulnerability that exists in improper HTML filtering of email message content. Certain code sequences bypass filters and successfully execute JavaScript, according to the iDefense advisory.

The flaw can lead to full compromise of an email account, with contact details sent to the attacker, according to the advisory.

The vulnerability exists in Lotus Domino Web Access 7.0, according to VeriSign.

A flaw in the LDAP server when handling requests was also identified. It can be exploited to cause a buffer overflow and crash the server, according to a Secunia advisory.

dominoflawsibminlotusmultipleproductsreportedsecurity