| Vulnerability Name: | CVE-2008-2240 (CCN-42552) | ||||||||
| Assigned: | 2008-05-20 | ||||||||
| Published: | 2008-05-20 | ||||||||
| Updated: | 2017-08-08 | ||||||||
| Summary: | Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long Accept-Language HTTP header. | ||||||||
| CVSS v3 Severity: | 10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C) 8.3 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
7.7 High (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-119 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2008-2240 Source: CCN Type: SA30310 IBM Lotus Domino Web Server Cross-Site Scripting and Buffer Overflow Source: SECUNIA Type: Vendor Advisory 30310 Source: CCN Type: SA30332 IBM Lotus Domino 6 Web Server Cross-Site Scripting and Buffer Overflow Source: SECUNIA Type: Vendor Advisory 30332 Source: CCN Type: SECTRACK ID: 1020098 IBM Lotus Domino Web Server Stack Overflow in Processing HTTP 'Accept-Language' Header Lets Remote Users Execute Arbitrary Code Source: CCN Type: IBM Technote (FAQ) 1303057 Lotus Domino Web server Accept-Language stack overflow Source: CONFIRM Type: Patch http://www-1.ibm.com/support/docview.wss?uid=swg21303057 Source: VIM Type: UNKNOWN 20080522 Who's Right Source: VIM Type: UNKNOWN 20080522 Who's Right Source: CCN Type: MWR InfoSecurity Security Advisory, 20th March 2008 IBM Lotus Domino Accept-Language Stack Overflow Source: MISC Type: Patch http://www.mwrinfosecurity.com/publications/mwri_ibm-lotus-domino-accept-language-stack-overflow_2008-05-20.pdf Source: CCN Type: OSVDB ID: 45415 IBM Lotus Domino Web Server Accept-Language HTTP Header Remote Overflow Source: BID Type: UNKNOWN 29310 Source: CCN Type: BID-29310 IBM Lotus Domino Web Server 'Accept Language' HTTP Header Buffer Overflow Vulnerability Source: SECTRACK Type: UNKNOWN 1020098 Source: VUPEN Type: UNKNOWN ADV-2008-1597 Source: XF Type: UNKNOWN ibm-lotusdomino-acceptlanguage-bo(42552) Source: XF Type: UNKNOWN ibm-lotusdomino-acceptlanguage-bo(42552) Source: CCN Type: Rapid7 Vulnerability and Exploit Database [05-20-2008] IBM Lotus Domino Web Server Accept-Language Stack Buffer Overflow | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||