===================================================================== CERT-Renater Note d'Information No. 2009/VULN097 _____________________________________________________________________ DATE : 18/03/2009 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running Lotus Notes File Viewer for WordPerfect ====================================================================== http://www-01.ibm.com/support/docview.wss?uid=swg21377573 ______________________________________________________________________ Potential Security Issue with Lotus Notes File Viewer for WordPerfect Flash (Alert) Abstract iDefense Labs contacted IBM Lotus to report a potential keyview buffer overflow vulnerability in Lotus Notes. In specific situations it was found that there is the possibility to execute arbitrary code. To successfully exploit this vulnerability, an attacker would need to send a specially crafted WordPerfect Document (WPD) file attachment to users, and the users would then have to double-click and "View" the attachment. The advisory can be found at the following URL: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=3D77=4 The CVE identifier is CVE-2008-4564 Content This issue was reported to Quality Engineering as SPR#s PRAD7NSR9Z. We have received a software update from the technology vendor involved and will address the issue in future Maintenance Releases/Fix Packs. In the meantime, you must contact IBM Support to obtain the patch, which is available for Notes 7.x and 8.x client versions. Lotus Notes version 8.5 is not vulnerable. Note: The issue was determined to impact the Windows-based Notes clients. It does not impact the Lotus Domino Server. Refer to the Upgrade Central site for details on upgrading Notes/Domino. Workarounds for Notes 7.x and 8.0x client versions: Option 1: Contact IBM Support to obtain the patch for the Notes client. Option 2: Alternately, you can disable the affected file viewer by following one of the options in the "How to disable viewers within Lotus Notes" section of this technote. Workaround for Notes 6.x client versions: If you are interested in protecting yourself from this vulnerability, we recommend disabling the viewer as described in the "How to disable Viewers within Lotus Notes" section of this technote. There is no software fix available for the 6.x Notes client version. Workaround for Notes 5.x client versions: If you are interested in protecting yourself from this vulnerability, we recommend disabling the viewer as described in the "How to disable Viewers within Lotus Notes" section of this technote. There is no software fix available for the 5.x Notes client version. How to disable Viewers within Notes: Option 1 : Delete the keyview.ini file in the Notes program directory. This disables ALL viewers. When a user clicks View (for any file attachment), a dialog box will display with the message "Unable to locate the viewer configuration file." Option 2 : Delete or rename the problem DLL file, which in this case is wp6sr.dll. When a user tries to view a WordPerfect document file type, a dialog box will display with the message "The viewer display window could not be initialized." All other file types work without returning the error message. Option 3 : Comment out specific lines in keyview.ini for any references to the problem file (dll). To comment a line, you precede it with a semi-colon (;). When a user tries to view the specific file type, a dialog box will display with the message "The viewer display window could not be initialized." For Example: [KVWKBVE] --> this is the section of the keyview.ini ;178=wp6sr.dll ---> this would be the result of the WordPerfect dll commented out Additional Background In general, users are strongly urged to use caution when opening or viewing unsolicited file attachments. The attachments will not auto-execute upon opening or previewing the email message; the file attachment must be opened by the user using the mentioned file viewers. In some cases, further user action is also required to trigger the exploit. Security Rating using Common Vulnerability Scoring System (CVSS) v2 CVSS Base Score: < 9.3 > ---- Impact Subscore: < 10 > ---- Exploitability Subscore: < 8.6 > CVSS Temporal Score: < 7.3 > CVSS Environmental Score: < Undefined* > Overall CVSS Score: < 7.3 > Base Score Metrics: * Related exploit range/Attack Vector: < Network > * Access Complexity: < Medium > * Authentication < None > * Confidentiality Impact: < Complete > * Integrity Impact: < Complete > * Availability Impact: < Complete > Temporal Score Metrics: * Exploitability: < Proof of Concept Code> * Remediation Level: < Official Fix > * Report Confidence: < Confirmed > References: * CVSS v2 Complete Documentation * CVSS v2 Online Calculator *The CVSS Environment Score is customer environment-specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the referenced links. Copyright and trademark information IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml. ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================