CVE-2007-1675
published 2007-03-28CVE-2007-1675: Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap.exe) in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote…
PriorityP274critical10CVSS 2.0
AVNACLAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
61.22%
99.1th percentile
Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap.exe) in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to cause a denial of service via a long username.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x54\x30\x30\x57\x54\x30\x30\x57
bytes↗
\x54\x30\x30\x57\x54\x30\x30\x57
bytes↗
\xb8\x54\x30\x30\x57\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7
- →Exploit sends multiple 'a001 admin <shellcode>' IMAP commands before triggering the overflow, placing shellcode into memory via the admin command prior to the CRAM-MD5 authentication step (egghunter technique); detect repeated large IMAP 'admin' commands from the same source. ↗
- →The exploit egg tag bytes 0x54 0x30 0x30 0x57 (repeated twice: T00W T00W) are embedded in shellcode as an egghunter marker; scan IMAP traffic for this byte sequence. ↗
- →The overflow is triggered in the CRAM-MD5 authentication path; the base64-encoded AUTHENTICATE response containing NOP sleds (0x90 repeated) followed by shellcode is the attack vector — detect large base64 blobs in IMAP AUTHENTICATE responses. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6h36-pmmf-r3cx: Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap
ghsa_unreviewed·2022-05-01
CVE-2007-1675 [HIGH] GHSA-6h36-pmmf-r3cx: Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap
Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap.exe) in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to cause a denial of service via a long username.
VulnCheck
IBM domino Out-of-bounds Write
vulncheck·2007·CVSS 10.0
CVE-2007-1675 [CRITICAL] IBM domino Out-of-bounds Write
IBM domino Out-of-bounds Write
Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap.exe) in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to cause a denial of service via a long username.
Affected: IBM domino
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=a9c54f79-d780-437b-a7f5-a74960e299d5&CommunityKey=8af7f28f-02f1-4107-8639-93a60b6546d4&tab=librarydocuments
No detection rules found.
Exploit-DB
Lotus Domino IMAP4 Server 6.5.4 - Remote Buffer Overflow
exploitdb·2007-07-20
CVE-2007-1675 Lotus Domino IMAP4 Server 6.5.4 - Remote Buffer Overflow
Lotus Domino IMAP4 Server 6.5.4 - Remote Buffer Overflow
---
###########################################################################################
# Lotus Domino IMAP4 Server Release 6.5.4 / Windows 2000 Advanced Server x86 Remote Exploit
###########################################################################################
# Vulnerable: IBM Lotus Domino & prdelka
#
# Exploitation steps:
# 1) The instruction "call dword [ecx]" is performed with user supplied ECX
# 2) EAX reference our buffer from retaddr onward
# 3) we put pointer in ECX to a pointer referencing "call eax"
# 4) a small payload decrements eax and then jmp's into the eax buffer due
# to size limitations.
# 5) our larger payload is then executed.
#
# muts exploit would not work for us, his egghunt uses 0x2e which
Exploit-DB
IBM Lotus Domino Server 6.5 - Remote Overflow
exploitdb·2007-03-31
CVE-2007-1675 IBM Lotus Domino Server 6.5 - Remote Overflow
IBM Lotus Domino Server 6.5 - Remote Overflow
---
#!/usr/bin/python
#
# IBM Lotus Domino Server 6.5 PRE AUTH Remote Exploit
# Tested on windows 2003 server SP0.
# Coded by Mati Aharoni
# [email protected]
# http://www.offensive-security.com
# Notes:
# * Not the the faint of heart.
# * Iris, I love you
# Skeleton exploit shamelessly ripped off Winny Thomas
#
# bt ~ # ./domino 192.168.0.38
# [*] IBM Lotus Domino Server 6.5 Remote Exploit
# [*] muts {-at-} offensive-security.com
#
# [*] Sending bindshell *somewhere* into memory
# [*] Sending bindshell *somewhere* into memory
# [*] Sending bindshell *somewhere* into memory
# [*] Sending bindshell *somewhere* into memory
# * OK Domino IMAP4 Server Release 6.5 ready Sat, 31 Mar 2007 01:45:32 -0800
#
# + PDAwMzU5QjhGLjg4MjU3MkFGLjAwMD
Exploit-DB
IBM Lotus Domino Server 6.5 - 'Username' Remote Denial of Service
exploitdb·2007-03-29
CVE-2007-1675 IBM Lotus Domino Server 6.5 - 'Username' Remote Denial of Service
IBM Lotus Domino Server 6.5 - 'Username' Remote Denial of Service
---
#!/usr/bin/python
#
# Remote DOS exploit code for IBM Lotus Domino Server 6.5. Tested on windows
# 2000 server SP4. The code crashes the IMAP server. Since this is a simple DOS
# where 256+ (but no more than 270) bytes for the username crashes the service
# this is likely to work on other windows platform aswell. Maybe someone can carry this further and come out
# with a code exec exploit.
#
# Author shall bear no reponsibility for any screw ups caused by using this code
# Winny Thomas :-)
#
import sys
import md5
import struct
import base64
import socket
def ExploitLotus(target):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target, 143))
response = sock.recv(1024)
print response
auth = 'a0
No writeups or analysis indexed.
http://secunia.com/advisories/24633http://www-1.ibm.com/support/docview.wss?uid=swg21257028http://www.securityfocus.com/bid/23172http://www.securityfocus.com/bid/23173http://www.securitytracker.com/id?1017823http://www.vupen.com/english/advisories/2007/1133http://www.zerodayinitiative.com/advisories/ZDI-07-011.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/33276http://secunia.com/advisories/24633http://www-1.ibm.com/support/docview.wss?uid=swg21257028http://www.securityfocus.com/bid/23172http://www.securityfocus.com/bid/23173http://www.securitytracker.com/id?1017823http://www.vupen.com/english/advisories/2007/1133http://www.zerodayinitiative.com/advisories/ZDI-07-011.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/33276
2007-03-28
Published
Exploited in the wild