Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against IBM Lotus Domino LDAP Heap Overflow Vulnerability

Subscribe

Check Point Reference: CPAI-2007-082
Date Published:
Severity:
Source: Secunia Advisory: SA24633
Industry Reference(s): CVE-2007-1739
Protection Provided by: VPN-1
  • NGX R65
  • NGX R62
  • NGX R61
  • NGX R60
  • NG with Application Intelligence R55W
  • NG with Application Intelligence R55
VSX
  • NGX
InterSpect
  • NGX
  • 2.0 and 1.x
Connectra
  • NGX R62
  • NGX R61
Who is Vulnerable?
IBM Lotus Domino 6.x prior to 6.5.6
IBM Lotus Domino 7.x prior to 7.0.2 FP1
Vulnerability Description
A buffer overflow vulnerability exists in IBM Lotus Domino server. IBM Lotus Domino Server is a software that provides mail, messaging, calendaring for multiple platforms. The flaw is within the IBM Lotus Domino LDAP service. Lightweight Directory Access Protocol (LDAP) is Internet standard protocol designed for querying and modifying directory services. The vulnerability could be exploited by remote attackers to crash the service or execute arbitrary code via a specially crafted LDAP request sent to an affected server.
Update/Patch Available
Upgrade your product to version 6.5.6 or 7.0.2 (Fix Pack 1):
http://www14.software.ibm.com/webapp/download/support.jsp
Vulnerability Details
The flaw is due to a boundary error within the IBM Lotus Domino LDAP service that fails to properly handle specially crafted LDAP requests. A Remote attacker can exploit this issue via a specially crafted LDAP request that contains an overly long DN (Distinguished Name) sent to a vulnerable server. Successful exploitation may allow an attacker to create a denial of service condition or execute arbitrary code on an affected server.

Protection Overview
By enabling this protection, SmartDefense will detect and block malformed LDAP requests with an overly long DN sent to the LDAP server.

In order for the protection to be activated, update your VPN-1/InterSpect/Connectra product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

VPN-1 NGX R65 & R62

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > LDAP > Block IBM Lotus Domino LDAP Invalid DN Vulnerability.
2. In the configuration pane, under Settings > Mode, check Active.



3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: LDAP Protections
Attack Information: IBM LDAP invalid DN detected

VPN-1 NGX R61, R60 & VPN-1 NG with Application Intelligence R55W

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > LDAP.
2. Select the following protection:

Block IBM Lotus Domino LDAP Invalid DN Vulnerability

3. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: LDAP Protections
Attack Information: IBM LDAP invalid DN detected

VPN-1 NG with Application Intelligence R55

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > LDAP.
2. Select the following protection:

Block IBM Lotus Domino LDAP Invalid DN Vulnerability

3. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
Rule #99874 will appear on the SmartView Tracker.

VPN-1 VSX NGX

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > LDAP.
2. Select the following protection:

Block IBM Lotus Domino LDAP Invalid DN Vulnerability

3. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
Rule #99874 will appear on the SmartView Tracker.

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2.In the SmartDefense tree, click Application Intelligence > LDAP.
3. Select the following protection:

Block IBM Lotus Domino LDAP Invalid DN Vulnerability

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: LDAP Protections
Attack Information: IBM LDAP invalid DN detected

InterSpect 2.0

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > LDAP.
2. Select the following protection:

Block IBM Lotus Domino LDAP Invalid DN Vulnerability

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: LDAP Protections
Attack Information: IBM LDAP invalid DN detected

Connectra NGX R62 & R61

How Can I Protect My Network?
1. In the left-hand menu, click Security > SmartDefense > Application Intelligence.
2. In the Dynamic Attacks pane, select the following:

Block IBM Lotus Domino LDAP Invalid DN Vulnerability

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
In case of an attack, the following log entries will be displayed:

Attack Name: LDAP Protections
Attack Information: IBM LDAP invalid DN detected