CVE-2008-2240
published 2008-05-22CVE-2008-2240: Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of…
PriorityP266critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
64.81%
99.2th percentile
Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long Accept-Language HTTP header.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
offset 56: \xff\xff\xff\xfe (Fix Second crash ESI)
bytes↗
offset 68: \xec\xf0\xfa\x7f (Fix Second crash EAX)
bytes↗
offset 104: \x30\xf0\xfa\x7f (Fix First crash)
- →Alert on any HTTP request where the Accept-Language header exceeds 114 bytes — this is the exact trigger threshold for the overflow. ↗
- →The Metasploit exploit uses a 116-byte alphanumeric Accept-Language value with specific 4-byte overwrites at offsets 56, 68, 104, and 112 — look for Accept-Language headers of exactly this length containing embedded little-endian DWORD values such as 0xFFFFFFFE. ↗
- →The exploit uses a static User-Agent string 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)' combined with an oversized Accept-Language header — correlate both fields for higher-fidelity detection. ↗
- →The exploit sets 'Connection: keep-alive' and 'Keep-Alive: 300' alongside the malicious Accept-Language header — this combination on port 80 targeting Lotus Domino is a strong signal. ↗
- →Payload bad characters for this exploit are null byte, newline, space, comma, and semicolon (\x00\x0a\x20\x2c\x3b) — their absence in an oversized Accept-Language header is consistent with exploit traffic. ↗
- ·The exploit targets IBM Lotus Domino Web Server strictly before versions 7.0.3 FP1 and 8.0.1; patched versions are not affected. ↗
- ·The Metasploit module targets Windows platforms only (Windows 2000, XP, 2003 SP1/SP2); NX-enabled and non-NX targets use different ROP gadget addresses from specific DLLs (fontmanager.dll, nnotes.dll, nlsccstr.dll, ntdll.dll, net.dll, j9gc23.dll). ↗
- ·EXITFUNC is set to 'thread', meaning the exploit spawns a thread for shellcode execution rather than exiting the process — crash-based detection may not fire reliably on successful exploitation. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
IBM Lotus Domino Web Server - Accept-Language Stack Buffer Overflow (Metasploit)
exploitdb·2010-11-11
CVE-2008-2240 IBM Lotus Domino Web Server - Accept-Language Stack Buffer Overflow (Metasploit)
IBM Lotus Domino Web Server - Accept-Language Stack Buffer Overflow (Metasploit)
---
##
# $Id: domino_http_accept_language.rb 10998 2010-11-11 22:43:22Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'IBM Lotus Domino Web Server Accept-Language Stack Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in IBM Lotus Domino Web Server
prior to version 7.0.3FP1 and 8.0.1. This flaw is triggered by any HTTP
request with an Accept-Language header greater than 114 bytes.
},
'Author' => [ 'Fairuzan Roslan ria
Metasploit
IBM Lotus Domino Web Server Accept-Language Stack Buffer Overflow
metasploit
IBM Lotus Domino Web Server Accept-Language Stack Buffer Overflow
IBM Lotus Domino Web Server Accept-Language Stack Buffer Overflow
This module exploits a stack buffer overflow in IBM Lotus Domino Web Server prior to version 7.0.3FP1 and 8.0.1. This flaw is triggered by any HTTP request with an Accept-Language header greater than 114 bytes.
No writeups or analysis indexed.
http://secunia.com/advisories/30310http://secunia.com/advisories/30332http://www-1.ibm.com/support/docview.wss?uid=swg21303057http://www.attrition.org/pipermail/vim/2008-May/001988.htmlhttp://www.attrition.org/pipermail/vim/2008-May/001989.htmlhttp://www.mwrinfosecurity.com/publications/mwri_ibm-lotus-domino-accept-language-stack-overflow_2008-05-20.pdfhttp://www.securityfocus.com/bid/29310http://www.securitytracker.com/id?1020098http://www.vupen.com/english/advisories/2008/1597https://exchange.xforce.ibmcloud.com/vulnerabilities/42552http://secunia.com/advisories/30310http://secunia.com/advisories/30332http://www-1.ibm.com/support/docview.wss?uid=swg21303057http://www.attrition.org/pipermail/vim/2008-May/001988.htmlhttp://www.attrition.org/pipermail/vim/2008-May/001989.htmlhttp://www.mwrinfosecurity.com/publications/mwri_ibm-lotus-domino-accept-language-stack-overflow_2008-05-20.pdfhttp://www.securityfocus.com/bid/29310http://www.securitytracker.com/id?1020098http://www.vupen.com/english/advisories/2008/1597https://exchange.xforce.ibmcloud.com/vulnerabilities/42552
2008-05-22
Published