{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Lotus Web Access 7.X.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Lotus Domino 7.X ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Lotus Domino 6.X ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Lotus Web Access (Notes) 6.X ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nTrois vuln\u00e9rabilit\u00e9s sont pr\u00e9sentes dans IBM Lotus Domino :\n\n-   la premi\u00e8re de type d\u00e9bordement de tampon a \u00e9t\u00e9 identifi\u00e9e dans le\n    service mettant en \u0153uvre le protocole de messagerie IMAP ;\n-   la deuxi\u00e8me, \u00e9galement de type d\u00e9bordement de m\u00e9moire, concerne le\n    serveur d\u0027annuaire LDAP ;\n-   la derni\u00e8re est due \u00e0 un manque de contr\u00f4le de certains param\u00e8tres\n    pass\u00e9s \u00e0 l\u0027application Lotus Domino Web Access.\n\nLes deux premi\u00e8res vuln\u00e9rabilit\u00e9s peuvent \u00eatre utilis\u00e9es par un\nutilisateur malveillant afin de provoquer un d\u00e9ni de service sur la\nmachine vuln\u00e9rable. Quant \u00e0 la troisi\u00e8me, elle peut \u00eatre exploit\u00e9e pour\nr\u00e9aliser une attaque de type Cross-Site Scripting.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2007-03-28T00:00:00",
  "last_revision_date": "2007-03-28T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM swg21257248 du 27 mars 2007 :",
      "url": "http://www.1-ibm.com/support/docview.wss?uid=swg21257248"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM swg21257026 du 27 mars 2007 :",
      "url": "http://www.1-ibm.com/support/docview.wss?uid=swg21257026"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM swg21257028 du 27 mars 2007 :",
      "url": "http://www.1-ibm.com/support/docview.wss?uid=swg21257028"
    }
  ],
  "reference": "CERTA-2007-AVI-148",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-03-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans IBM Lotus Domino permettent \u00e0\nun utilisateur distant de provoquer un d\u00e9ni de service ou de r\u00e9aliser\nune attaque par injection de code indirecte (Cross-Site Scripting).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Lotus Domino",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 IBM du 27 mars 2007",
      "url": null
    }
  ]
}