CVE-2010-3407
published 2010-09-16CVE-2010-3407: Stack-based buffer overflow in the MailCheck821Address function in nnotes.dll in the nrouter.exe service in the server in IBM Lotus Domino 8.0.x before 8.0.2…
PriorityP267critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
41.48%
98.5th percentile
Stack-based buffer overflow in the MailCheck821Address function in nnotes.dll in the nrouter.exe service in the server in IBM Lotus Domino 8.0.x before 8.0.2 FP5 and 8.5.x before 8.5.1 FP2 allows remote attackers to execute arbitrary code via a long e-mail address in an ORGANIZER:mailto header in an iCalendar calendar-invitation e-mail message, aka SPR NRBY7ZPJ9V.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
| ibm | lotus_domino | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
nnotes!MailCheck821Address+0xb09: e80239d9ff call nnotes!Cstrcpy (60007200)
- →Detect oversized ORGANIZER:mailto header in iCalendar (VCALENDAR) email bodies delivered over SMTP — a string of 2374+ bytes in the ORGANIZER:mailto field indicates exploitation attempt. ↗
- →Inspect inbound SMTP traffic on port 25 for iCalendar attachments (Content-Type: text/calendar) containing METHOD:COUNTER and an abnormally long ORGANIZER:mailto value. ↗
- →Monitor nrouter.exe for crashes or unexpected EIP values (e.g., 0x42424242) indicating stack return-address overwrite via the MailCheck821Address code path. ↗
- →Alert on iCalendar emails containing both METHOD:COUNTER and a VCALENDAR body with ORGANIZER:mailto exceeding ~2374 bytes — the exact offset required to overwrite the saved return address. ↗
- →No user interaction is required; nrouter processes the malicious email automatically, so detection must be at the network/SMTP layer rather than relying on endpoint user activity. ↗
- →Exploit payload uses AlphanumMixed encoding with ECX as the buffer register and a stack adjustment of -3500; look for alphanumeric shellcode patterns in the ORGANIZER field following the 2374-byte offset. ↗
- ·Exploitation requires a valid Lotus Domino mailbox account as the RCPT TO target; blind mass-mailing to arbitrary addresses will not trigger the vulnerable code path. ↗
- ·The Metasploit module's check function fingerprints the banner for 'Lotus Domino Release 8.5' only; the vulnerability also affects 8.0.x branches, so banner-based detection may under-report scope. ↗
- ·Bad characters for payload encoding include bytes 0x00–0x08, 0x10–0x18, 0x1a–0x1f, 0x2c, and 0x80–0xff; payloads not respecting these constraints will fail or crash without code execution. ↗
- ·ROP gadget addresses (0x6030582B, 0x604C4222) and MSVCR71.dll address (0x7C35287F) are version/SP-specific; they apply only to the exact Domino 8.5 builds on Windows 2000 SP4, Server 2003 SP0, and Server 2003 SP2 respectively. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
IBM Lotus Domino iCalendar - MAILTO Buffer Overflow (Metasploit)
exploitdb·2011-04-04
CVE-2010-3407 IBM Lotus Domino iCalendar - MAILTO Buffer Overflow (Metasploit)
IBM Lotus Domino iCalendar - MAILTO Buffer Overflow (Metasploit)
---
##
# $Id: domino_icalendar_organizer.rb 12236 2011-04-04 17:43:34Z sinn3r $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 "IBM Lotus Domino iCalendar MAILTO Buffer Overflow",
'Description' => %q{
This module exploits a vulnerability found in IBM Lotus Domino iCalendar. By
sending a long string of data as the "ORGANIZER;mailto" header, process "nRouter.exe"
crashes due to a Cstrcpy() routine in nnotes.dll, which allows remote attackers to
gain arbitrary code execution.
No
Exploit-DB
IBM Lotus Domino iCalendar - Email Address Stack Buffer Overflow
exploitdb·2010-09-14
CVE-2010-3407 IBM Lotus Domino iCalendar - Email Address Stack Buffer Overflow
IBM Lotus Domino iCalendar - Email Address Stack Buffer Overflow
---
source: http://labs.mwrinfosecurity.com/advisories/lotus_domino_ical_stack_buffer_overflow/
IBM Lotus Domino iCalendar Email Address Stack Buffer Overflow Vulnerability
Package Name: Lotus Domino Server
Date Reported: 2010-01-09
Affected Versions: Versions 8.0 and 8.5 on AIX, AIX 64bit, Linux, Linux iSeries, Linux
zSeries, Solaris, Windows, Windows 64bit, z/OS
CVE Reference Not Yet Assigned
Author A. Plaskett
Severity High Risk
Local/Remote Remote
Impact The vulnerability would enable an attacker to execute arbitrary code
on the system in the context of the currently executing nrouter process.
Vulnerability Class Stack based buffer overflow
Vendor URL http://www.ibm.com
Version 8.0, 8.5
Vendor Response A patch is avai
Metasploit
IBM Lotus Domino iCalendar MAILTO Buffer Overflow
metasploit
IBM Lotus Domino iCalendar MAILTO Buffer Overflow
IBM Lotus Domino iCalendar MAILTO Buffer Overflow
This module exploits a vulnerability found in IBM Lotus Domino iCalendar. By sending a long string of data as the "ORGANIZER;mailto" header, process "nRouter.exe" crashes due to a Cstrcpy() routine in nnotes.dll, which allows remote attackers to gain arbitrary code execution. Note: In order to trigger the vulnerable code path, a valid Domino mailbox account is needed.
No writeups or analysis indexed.
http://labs.mwrinfosecurity.com/advisories/lotus_domino_ical_stack_buffer_overflow/http://labs.mwrinfosecurity.com/files/Advisories/mwri_lotus-domino-ical-stack-overflow_2010-09-14.pdfhttp://secunia.com/advisories/41433http://securitytracker.com/id?1024448http://www-01.ibm.com/support/docview.wss?uid=swg21446515http://www-10.lotus.com/ldd/r5fixlist.nsf/8d1c0550e6242b69852570c900549a74/52f9218288b51dcb852576c600741f72?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/8d1c0550e6242b69852570c900549a74/613a204806e3f211852576e2006afa3d?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/8d1c0550e6242b69852570c900549a74/af36678d60bd74288525778400534d7c?OpenDocumenthttp://www.exploit-db.com/exploits/15005http://www.securityfocus.com/archive/1/513706/100/0/threadedhttp://www.securityfocus.com/bid/43219http://www.vupen.com/english/advisories/2010/2381http://www.zerodayinitiative.com/advisories/ZDI-10-177/https://exchange.xforce.ibmcloud.com/vulnerabilities/61790http://labs.mwrinfosecurity.com/advisories/lotus_domino_ical_stack_buffer_overflow/http://labs.mwrinfosecurity.com/files/Advisories/mwri_lotus-domino-ical-stack-overflow_2010-09-14.pdfhttp://secunia.com/advisories/41433http://securitytracker.com/id?1024448http://www-01.ibm.com/support/docview.wss?uid=swg21446515http://www-10.lotus.com/ldd/r5fixlist.nsf/8d1c0550e6242b69852570c900549a74/52f9218288b51dcb852576c600741f72?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/8d1c0550e6242b69852570c900549a74/613a204806e3f211852576e2006afa3d?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/8d1c0550e6242b69852570c900549a74/af36678d60bd74288525778400534d7c?OpenDocumenthttp://www.exploit-db.com/exploits/15005http://www.securityfocus.com/archive/1/513706/100/0/threadedhttp://www.securityfocus.com/bid/43219http://www.vupen.com/english/advisories/2010/2381http://www.zerodayinitiative.com/advisories/ZDI-10-177/https://exchange.xforce.ibmcloud.com/vulnerabilities/61790
2010-09-16
Published