IBM Lotus Domino Cross-Site Scripting and HTTP Response Splitting vulnerabilities

["MustLive" <mustlive () websecurity com ua>]

Hello list!

This month (at 15th of August) IBM released the advisory about IBM Lotus 
Domino Cross-Site Scripting and HTTP Response Splitting vulnerabilities, 
which I've informed them about in May. This is only the part of all 
vulnerabilities, which I've found in their software, and they are working to 
fix other vulnerabilities.

IBM Security Bulletin: Aug-2012 IBM Lotus Domino Web Server Cross-Site 
Scripting Vulnerabilities
http://www-01.ibm.com/support/docview.wss?uid=swg21608160

CVE IDs: CVE-2012-3301, CVE-2012-3302.

Note, that regardless in title are mentioned only Cross-Site Scripting 
vulnerabilities, there is also HTTP Response Splitting described in it.

-------------------------
Affected products:
-------------------------

Vulnerable are IBM Lotus Domino 8.5.3 and previous versions. These 
vulnerabilities will be fixed in Domino 8.5.4.

For fixes, workarounds and mitigations reference to above-mentioned IBM 
Security Bulletin.

While fixes for all vulnerabilities are planned for inclusion in Domino 
8.5.4, workarounds exist for some of them in Domino servers 7.0 and later by 
enabling a single INI setting (see bellow).

----------
Details:
----------

In the advisory IBM mentioned four vulnerabilities.

1. IBM Lotus Domino WebMail Cross-Site Scripting.
CVE ID: CVE-2012-3302

2. IBM Lotus Domino Help Cross-Site Scripting on HTTP Server.
CVE ID: CVE-2012-3302

3. IBM Lotus Domino HTTP Server Response Splitting.
CVE ID: CVE-2012-3301

4. IBM Lotus Domino HTTP Server Response Splitting.
CVE ID: CVE-2012-3301

The first one is in reality 2 XSS holes (in Webmail) and the second one is 
in reality four XSS holes (in Help). It's just IBM like to put multiple 
vulnerabilities of the same type into one vulnerability in their advisories. 
The third one is XSS via HTTP Response Splitting (variation of the fourth 
vulnerability). IBM put all the holes in their own order, different then I 
sent them.

Note, that there is inaccuracy in the description of the third vulnerability 
(concerning browsers vulnerable to this attack). Earlier I've already 
informed IBM about this inaccuracy and they should fix it.

------------------
Workaround:
------------------

There is a workaround for all mentioned in the advisory XSS vulnerabilities:

To avoid this attack, administrators can set the following variable on the 
Domino server NOTES.INI, available in release 7.0 and later:

DominoValidateFramesetSRC=1

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/