Re: Lotus ESMTP Service (Lotus Domino Release 5.0.1 (Intl))

[visi () CMU EDU (Cory Visi)]

This bug has been fixed in Domino 5.04. This version of Domino is
not available yet (not even by QMR update).
Customers can request a hotfix if needed.

Here's a little info about Lotus and how they treat stuff like this.
As far as I can tell they don't have anyone reading BugTraq.
It has been 7 business days since I reported the problem to Lotus Technical
Support and they have not gotten back to me.
In the event of future problems, they told me to contact Lotus Technical
Support (I assume they mean by phone).

The information I reported regarding the bug came from Iris.

     .-.        ,~~-.      .-~~-.
 ~._'_.'        \_   \    /      `~~-
   |              `~- \  /
   `.__.-'ory          \/isi

On Thu, 18 May 2000, Michal Zalewski wrote:

-=(>Not much to say. While performing basic input validation checks in Lotus
-=(>Domino ESMTP service (see subject) running on the top of Windows NT system
-=(>(this applies probably to other platforms as well), within approximately
-=(>30 seconds we found remote buffer overflow leading to system crash (and,
-=(>if exploited, to remote system compromise). Sometimes I don't believe this
-=(>is so simple! I could imagine that voluntary wu-ftpd developers missed
-=(>some buffer-length checks while constructing process title - but when I
-=(>look at such hole in product developed by major company employing security
-=(>specialists, I ask my self is this intentional?:) Just kidding, but with
-=(>whole respect - I believe anyone looking at the source code could simply
-=(>SEE such buffer overflow - just like in Novell remote http administration
-=(>bug I reported three weeks ago. Hey, but stop, I'm not going to give
-=(>offence to these corporarions, sorry. Now, facts:
-=(>
-=(>220 *SNIP* Lotus Domino Release 5.0.1 (Intl) *SNIP*
-=(>HELO dood
-=(>250 *SNIP*
-=(>MAIL FROM: me@<four-kilobytes-of-junk>
-=(>(crash)
-=(>
-=(>
-=(>Btw. just to make it clear, I've got confirmation from Novell about http
-=(>administration remote buffer overflow. Also, they said upgraded modules
-=(>are available from their download area, and asked me to notify BQ readers.
-=(>
-=(>Above statements are my own oppinions and observations _only_. Standard
-=(>disclaimer applies.
-=(>
-=(>_______________________________________________________
-=(>Michal Zalewski [lcamtuf () tpi pl] [tp.internet/security]
-=(>[http://lcamtuf.na.export.pl] <=--=> bash$ :(){ :|:&};:
-=(>=-----=> God is real, unless declared integer. <=-----=
-=(>