Buffer overflow in IBM Domino Web Access
CVE-2007-4474
Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, inotes6w.dll, dwa7.dll, and dwa7w.dll, in Domino 6.x and 7.x allow remote attackers to execute arbitrary code, as demonstrated by an overflow from a long General_ServerName property value when calling the InstallBrowserHelperDll function in the Upload Module in the dwa7.dwa7.1 control in dwa7w.dll 7.0.34.1.
Vulnerability class: Buffer Overflow
EPSS: 0.442 (98.7th percentile) — read the EPSS interpretation.
Affected products
- Ibm Domino_web_access — versions 6.0, 6.0.1, 6.0.1.1
- Ibm Lotus_domino_web_access — versions 7.0.1, 7.0.34.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cret@cert.org (vdb-entry, x_refsource_SECTRACK)
- cret@cert.org (exploit, x_refsource_EXPLOIT-DB)
- cret@cert.org (Exploit, vdb-entry, x_refsource_BID)
- cret@cert.org (mailing-list, Exploit, x_refsource_FULLDISC)
- cret@cert.org (vdb-entry, x_refsource_XF)
- cret@cert.org (exploit, x_refsource_EXPLOIT-DB)
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
- cret@cert.org (vdb-entry, x_refsource_VUPEN)
- cret@cert.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cret@cert.org (exploit, x_refsource_EXPLOIT-DB)
Frequently asked questions
- What is CVE-2007-4474?
- CVE-2007-4474 is a vulnerability in IBM Domino Web Access, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2007-12-27.
- Is CVE-2007-4474 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.