Security Alert (A17-05-06): Multiple Vulnerabilities in IBM Notes and Domino


 

Published on: 24 May 2017

  
  

Description:

Multiple vulnerabilities are found in IBM Notes and Domino. The bundled Java virtual machine (JVM) is susceptible to different attacks as listed in the Oracle Critical Patch Update Advisories (Jan 2017) which could be remotely exploited without authentication. A remote attacker could exploit the vulnerabilities by enticing a user to open a specially-crafted file or visit a malicious website.

 

Affected Systems:

  • IBM Notes 9.0.1 to IBM Notes 9.0.1 Fix Pack 8
  • IBM Notes 8.5.3 to IBM Notes 8.5.3 Fix Pack 6 Interim Fix 14
  • IBM Domino 9.0.1 through 9.0.1 Feature Pack 8 Interim Fix 3
  • IBM Domino 8.5.3 through 8.5.3 Fix Pack 6 Interim Fix 18
  • All 9.0.x, 9.0, 8.5.x and 8.5 releases of IBM Notes and Domino prior to those listed above

 

Impact:

Depending on the vulnerability exploited, a successful attack could lead to arbitrary code execution, denial of services or information disclosure.

 

Recommendation:

The vendor has released fixes to address the issues and they can be downloaded at the following URLs:

  • JVM Patches for Notes and Domino 9.0.1.x
    http://www.ibm.com/support/docview.wss?uid=swg21657963

  • JVM Patches for Notes and Domino 8.5.3 Fix Pack 6
    http://www-01.ibm.com/support/docview.wss?uid=swg21663874

 

More Information:

http://www-01.ibm.com/support/docview.wss?uid=swg22000516
http://www-01.ibm.com/support/docview.wss?uid=swg22000602
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2183
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5546
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5547
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5548
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5549
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5552
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3231
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3241
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3252
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3253
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3259
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3260
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3261
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3272
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3289 



Tag: IBM , IBM Notes , Domino
Tags