CVE-2017-1274
published 2017-04-25CVE-2017-1274: IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by…
PriorityP276high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
6.79%
93.3th percentile
IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM X-Force ID: 124749.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | domino | — | — |
| ibm | domino | — | — |
| ibm | domino | — | — |
| ibm | domino | — | — |
| ibm | domino | — | — |
| ibm | domino | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x90 * 556 + rop_chain + \x90 * 20 + \xCC * remainder (total ~1500 bytes), base64-encoded, prefixed with '&', sent as IMAP EXAMINE mailbox argument
- →Detect oversized IMAP EXAMINE commands: alert on EXAMINE commands with mailbox name arguments exceeding normal length (exploit uses ~1500 bytes base64-encoded, prefixed with '&'), especially on TCP port 143. ↗
- →The exploit payload is base64-encoded and prefixed with '&' in the EXAMINE mailbox argument — inspect IMAP EXAMINE commands for '&' followed by a large base64 blob on port 143. ↗
- →Focus detection on 32-bit Windows Domino servers running nIMAP.EXE; these are at greatest risk as ASLR is less effective on 32-bit platforms. ↗
- →The exploit requires prior authentication (valid IMAP credentials); correlate large EXAMINE payloads with successful LOGIN events from the same session. ↗
- ·64-bit Domino deployments with ASLR enabled significantly reduce exploitability; 32-bit Windows deployments without ASLR are the primary high-risk targets. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wgq5-wwrv-g964: IBM Domino 8
ghsa_unreviewed·2022-05-14
CVE-2017-1274 [HIGH] CWE-119 GHSA-wgq5-wwrv-g964: IBM Domino 8
IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM X-Force ID: 124749.
VulnCheck
IBM domino Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2017·CVSS 8.8
CVE-2017-1274 [HIGH] IBM domino Improper Restriction of Operations within the Bounds of a Memory Buffer
IBM domino Improper Restriction of Operations within the Bounds of a Memory Buffer
IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM X-Force ID: 124749.
Affected: IBM domino
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=a9c54f79-d780-437b-a7f5-a74960e299d5&CommunityKey=8af7f28f-02f1-4107-8639-93a60b6546d4&
No detection rules found.
Exploit-DB
Lotus Domino 8.5.3 - 'EXAMINE' Stack Buffer Overflow DEP/ASLR Bypass (NSA's EMPHASISMINE)
exploitdb·2019-05-08
CVE-2017-1274 Lotus Domino 8.5.3 - 'EXAMINE' Stack Buffer Overflow DEP/ASLR Bypass (NSA's EMPHASISMINE)
Lotus Domino 8.5.3 - 'EXAMINE' Stack Buffer Overflow DEP/ASLR Bypass (NSA's EMPHASISMINE)
---
##########################################################
# #
# Here is a working version of the NSA's EMPHASISMINE #
# for IMAP Server Lotus Domino 8.5.3 FP0 #
# DEP/ASLR bypass #
# #
# Replace breakpoints with msfvenom payload #
# (ALPHANUMERIC) #
# I love you Alison Thompson OAM @ThirdWaveORG #
# Author: Charles Truscott @r0ss1n1 #
# #
###########################################################
import base64
import struct
import socket
import time
rop_and_roll = struct.pack(' ebx
rop_and_roll += struct.pack(' edx
rop_and_roll += struct.pack(' ecx
rop_and_roll += struct.pack('<I', 0x606609f9) # POP EDI # RETN [nnotes.dll]
rop_and_roll += struct.pack('<I', 0x62136802) # RETN (ROP NOP) [nxml
Exploit-DB
Microsoft Windows Kernel - 'win32k.sys' '.TTF' Font Processing Out-of-Bounds Read with Malformed 'glyf' Table 'win32k!fsc_CalcGrayRow' (Denial of Service)
exploitdb·2017-09-18
CVE-2017-8683 Microsoft Windows Kernel - 'win32k.sys' '.TTF' Font Processing Out-of-Bounds Read with Malformed 'glyf' Table 'win32k!fsc_CalcGrayRow' (Denial of Service)
Microsoft Windows Kernel - 'win32k.sys' '.TTF' Font Processing Out-of-Bounds Read with Malformed 'glyf' Table 'win32k!fsc_CalcGrayRow' (Denial of Service)
---
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1274
We have encountered a number of Windows kernel crashes in the win32k.sys driver while processing corrupted TTF font files:
---
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ff1effff, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 91a65a52, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (
Qualys
Shadow Brokers Fix for IBM Lotus Domino Released
blogs_qualys·2017-04-25·CVSS 8.8
[HIGH] Shadow Brokers Fix for IBM Lotus Domino Released
IBM has released a patch for Lotus Domino to plug a security flaw which was disclosed in the latest Shadow Broker revelations. Lotus Domino includes an IMAP server. IMAP or Internet Message Access Protocol is an Internet standard protocol used by e-mail clients to retrieve e-mail messages from the mail server over a TCP/IP connection. The server contains a stack buffer overflow in the handling of mailbox names. This vulnerability affects Domino server 9.0.1FP8 and earlier versions, and this exploit has been referred to by the “EMPHASISMINE” code name by Shadow Brokers. CVE-2017-1274 has been assigned to this issue.
The EXAMINE command selects a mailbox so that messages in the mailbox can be accessed. It is identical to SELECT command and returns the same output; however, the selected mail
Qualys
Shadow Brokers Fix for IBM Lotus Domino Released | Qualys
blogs_qualys·2017-04-25·CVSS 8.8
[HIGH] Shadow Brokers Fix for IBM Lotus Domino Released | Qualys
IBM has released a patch for Lotus Domino to plug a security flaw which was disclosed in the latest Shadow Broker revelations. Lotus Domino includes an IMAP server. IMAP or Internet Message Access Protocol is an Internet standard protocol used by e-mail clients to retrieve e-mail messages from the mail server over a TCP/IP connection. The server contains a stack buffer overflow in the handling of mailbox names. This vulnerability affects Domino server 9.0.1FP8 and earlier versions, and this exploit has been referred to by the “EMPHASISMINE” code name by Shadow Brokers. CVE-2017-1274 has been assigned to this issue.
The EXAMINE command selects a mailbox so that messages in the mailbox can be accessed. It is identical to SELECT command and returns the same output; however, the selected mail
http://packetstormsecurity.com/files/152786/Lotus-Domino-8.5.3-EXAMINE-Stack-Buffer-Overflow.htmlhttp://www.ibm.com/support/docview.wss?uid=swg22002280http://www.securityfocus.com/bid/97910http://www.securityfocus.com/bid/98019http://www.securitytracker.com/id/1038358https://www.kb.cert.org/vuls/id/676632http://packetstormsecurity.com/files/152786/Lotus-Domino-8.5.3-EXAMINE-Stack-Buffer-Overflow.htmlhttp://www.ibm.com/support/docview.wss?uid=swg22002280http://www.securityfocus.com/bid/97910http://www.securityfocus.com/bid/98019http://www.securitytracker.com/id/1038358https://www.kb.cert.org/vuls/id/676632
2017-04-25
Published
Exploited in the wild