Vulnerability Description
IBM Lotus Notes does not properly restrict access to password hashes in the Notes Address Book (NAB), which allows remote attackers to obtain sensitive information via the (1) password digest field in the Administration tab of a Lotus Notes client, (2) "PasswordDigest" and "HTTPPassword" fields in the document properties in the NAB, or (3) a direct query to the Domino LDAP server, a different vulnerability than CVE-2005-2428.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Lotus Notes | All versions |
References
- http://marc.info/?l=bugtraq&m=112456040418543&w=2
- http://www.venera.com/downloads/Lotus_password_disclosures.pdfExploitVendor Advisory
- http://marc.info/?l=bugtraq&m=112456040418543&w=2
- http://www.venera.com/downloads/Lotus_password_disclosures.pdfExploitVendor Advisory
FAQ
What is CVE-2005-2696?
CVE-2005-2696 is a vulnerability with a CVSS score of 5.0 (MEDIUM). IBM Lotus Notes does not properly restrict access to password hashes in the Notes Address Book (NAB), which allows remote attackers to obtain sensitive information via the (1) password digest field in...
How severe is CVE-2005-2696?
CVE-2005-2696 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2005-2696?
Check the references section above for vendor advisories and patch information. Affected products include: Ibm Lotus Notes.