Test ID:	1.3.6.1.4.1.25623.1.0.902420
Category:	General
Title:	IBM Lotus Domino Cookie File Authentication Bypass Vulnerability
Summary:	IBM Lotus Domino Server is prone to an authentication bypass vulnerability.
Description:	Summary: IBM Lotus Domino Server is prone to an authentication bypass vulnerability. Vulnerability Insight: The flaw is due to an error in the Server Controller authentication mechanism, which does not properly verify the COOKIEFILE path before using it to retrieve user's credentials. Vulnerability Impact: Successful exploitation may allow remote attackers to bypass the authentication mechanism by providing a malicious UNC path to COOKIEFILE. Affected Software/OS: IBM Lotus Domino versions 7.x and 8.x Solution: Upgrade to version 8.5.2 FP3 or 8.5.3 or later. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1519 BugTraq ID: 46985 http://www.securityfocus.com/bid/46985 Bugtraq: 20110322 ZDI-11-110: (0day) IBM Lotus Domino Server Controller Authentication Bypass Remote Code Execution Vulnerability (Google Search) http://www.securityfocus.com/archive/1/517119/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-11-110 http://securitytracker.com/id?1025241 http://secunia.com/advisories/43860 http://securityreason.com/securityalert/8164 http://www.vupen.com/english/advisories/2011/0758 Common Vulnerability Exposure (CVE) ID: CVE-2011-1520 http://publib.boulder.ibm.com/infocenter/domhelp/v8r0/index.jsp?topic=/com.ibm.help.domino.admin.doc/DOC/H_THE_DOMINO_CONTROLLER_AND_CONSOLE_OVER.html http://www.lotus.com/ldd/doc/domino_notes/rnext/help6_admin.nsf/2e73cbb2141acefa85256b8700688cea/0c50e423038555d085256c1d003a31f0?OpenDocument
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.