Description
Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, inotes6w.dll, dwa7.dll, and dwa7w.dll, in Domino 6.x and 7.x allow remote attackers to execute arbitrary code, as demonstrated by an overflow from a long General_ServerName property value when calling the InstallBrowserHelperDll function in the Upload Module in the dwa7.dwa7.1 control in dwa7w.dll 7.0.34.1.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
IBM Lotus Domino Web Access Upload Module Buffer Overflow
exploit/windows/browser/ibmlotusdomino_dwa_uploadmodule
Exploit-DB 4
- IBM Lotus Domino Web Access Upload Module - Remote Buffer Overflow (Metasploit) EDB-16502 · remote · Sep 20, 2010 · verified
- IBM Domino Web Access Upload Module - Overwrite (SEH) EDB-5111 · remote · Feb 13, 2008 · verified
- IBM Domino Web Access 7.0 Upload Module - 'inotes6.dll' Remote Buffer Overflow EDB-4818 · remote · Dec 30, 2007 · verified
- IBM Domino Web Access Upload Module - 'dwa7w.dll' Remote Buffer Overflow EDB-4820 · remote · Dec 30, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 1019138 vdb-entry
- 5111 exploit
- 26972 vdb-entry
- 20071220 IBM Domino Web Access Upload Control dwa7w.dll Memory Corruption mailing-list
- domino-dwa7w-bo(39175) vdb-entry
- 4820 exploit
- VU#963889 third-party-advisory
- ADV-2007-4296 vdb-entry
- 28184 third-party-advisory
- 4818 exploit
- 40954 vdb-entry