Vulnerability Description
Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, inotes6w.dll, dwa7.dll, and dwa7w.dll, in Domino 6.x and 7.x allow remote attackers to execute arbitrary code, as demonstrated by an overflow from a long General_ServerName property value when calling the InstallBrowserHelperDll function in the Upload Module in the dwa7.dwa7.1 control in dwa7w.dll 7.0.34.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Domino Web Access | 6.0 |
| Ibm | Lotus Domino Web Access | 7.0.1 |
Related Weaknesses (CWE)
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059233.htmlExploit
- http://osvdb.org/40954
- http://secunia.com/advisories/28184Vendor Advisory
- http://www.kb.cert.org/vuls/id/963889US Government Resource
- http://www.securityfocus.com/bid/26972Exploit
- http://www.securitytracker.com/id?1019138
- http://www.vupen.com/english/advisories/2007/4296
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39175
- https://www.exploit-db.com/exploits/4818
- https://www.exploit-db.com/exploits/4820
- https://www.exploit-db.com/exploits/5111
- http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059233.htmlExploit
- http://osvdb.org/40954
- http://secunia.com/advisories/28184Vendor Advisory
- http://www.kb.cert.org/vuls/id/963889US Government Resource
FAQ
What is CVE-2007-4474?
CVE-2007-4474 is a vulnerability with a CVSS score of 9.3 (HIGH). Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, inotes6w.dll, dwa7.dll, and dwa7w.dll, in Domino 6.x and 7.x allow remote attacker...
How severe is CVE-2007-4474?
CVE-2007-4474 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-4474?
Check the references section above for vendor advisories and patch information. Affected products include: Ibm Domino Web Access, Ibm Lotus Domino Web Access.