CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
4.0 | $0-$5k | 0.00 |
A vulnerability was found in IBM Lotus Notes R6.x (Groupware Software). It has been rated as problematic. This issue affects some unknown processing of the component Client. The manipulation as part of a Java Applet leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is availability. The summary by CVE is:
Buffer overflow in IBM Lotus Notes 6.5.x before 6.5.3 and 6.0.x before 6.0.5 allows remote attackers to cause a denial of service (crash) via unknown vectors related to Java applets, as identified by KSPR62F4KN.
The weakness was published 07/13/2004 by Jouko Pynnonen (Website). It is possible to read the advisory at secunia.com. The identification of this vulnerability is CVE-2004-2280 since 07/19/2005. Attacking locally is a requirement. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.
The commercial vulnerability scanner Qualys is able to test this issue with plugin 90141 (IBM Lotus Notes Multiple Unspecified Vulnerabilities).
Applying a patch is able to eliminate this problem. The bugfix is ready for download at lotus.com.
The vulnerability is also documented in the vulnerability database at X-Force (16713). secunia.com is providing further details. Similar entries are available at 23183 and 82135.
Product
Type
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.0VulDB Meta Temp Score: 4.0
VulDB Base Score: 4.0
VulDB Temp Score: 4.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Memory corruptionCWE: CWE-119
CAPEC: 🔍
ATT&CK: 🔍
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: DisableStatus: 🔍
0-Day Time: 🔍
Patch: lotus.com
Timeline
07/09/2004 🔍07/13/2004 🔍
07/13/2004 🔍
07/13/2004 🔍
07/13/2004 🔍
12/31/2004 🔍
07/19/2005 🔍
04/30/2007 🔍
06/28/2019 🔍
Sources
Vendor: ibm.comAdvisory: secunia.com⛔
Researcher: Jouko Pynnonen
Status: Not defined
Confirmation: 🔍
CVE: CVE-2004-2280 (🔍)
X-Force: 16713
Vulnerability Center: 14976 - IBM Lotus Notes Buffer Overflow via Java Applets, Medium
SecurityFocus: 10704 - IBM Lotus Notes Multiple Java Applet Vulnerabilities
Secunia: 12046 - IBM Lotus Notes Client Unspecified Java Applet Handling Vulnerabilities, Moderately Critical
OSVDB: 8418 - IBM Lotus Notes Client Unspecified Java Applet Handling Overflow
Misc.: 🔍
See also: 🔍
Entry
Created: 07/13/2004 14:33Updated: 06/28/2019 21:20
Changes: 07/13/2004 14:33 (80), 06/28/2019 21:20 (2)
Complete: 🔍
Cache ID: 3:F53:103
No comments yet. Languages: en.
Please log in to comment.