Details of VAR-200106-0168

ID

VAR-200106-0168

CVE

CVE-2001-0412

TITLE

Lotus Domino vulnerable to DoS via crafted unicode GET request

Trust: 0.8

sources: CERT/CC: VU#676552

DESCRIPTION

Cisco Content Services (CSS) switch products 11800 and earlier, aka Arrowpoint, allows local users to gain privileges by entering debug mode. The Lotus Domino Web Server contains a flaw that could be exploited to cause a denial of service. DIIOP by default listens on port 63148. Making continuous and unusually large connection requests to port 63148, will invoke a DIIOP session. Each such connection request will launch a new DIIOP session. Eventually this process will cause CPU utilization to spike to 100% on the target host

Trust: 4.14

sources: NVD: CVE-2001-0412 // CERT/CC: VU#676552 // CERT/CC: VU#601312 // CERT/CC: VU#642760 // CERT/CC: VU#555464 // BID: 2599 // VULHUB: VHN-3231

AFFECTED PRODUCTS

vendor:	lotus	model:	-	scope:	-	version:	-	Trust: 3.2
vendor:	cisco	model:	content services switch 11150	scope:	eq	version:	*	Trust: 1.0
vendor:	cisco	model:	content services switch 11800	scope:	eq	version:	*	Trust: 1.0
vendor:	cisco	model:	content services switch 11050	scope:	eq	version:	*	Trust: 1.0
vendor:	cisco	model:	content services switch 11150	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	content services switch 11050	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	content services switch 11800	scope:	-	version:	-	Trust: 0.6
vendor:	lotus	model:	domino	scope:	eq	version:	5.0.6	Trust: 0.3
vendor:	lotus	model:	domino	scope:	eq	version:	5.0.5	Trust: 0.3
vendor:	lotus	model:	domino	scope:	eq	version:	5.0.4	Trust: 0.3
vendor:	lotus	model:	domino	scope:	eq	version:	5.0.3	Trust: 0.3
vendor:	lotus	model:	domino	scope:	eq	version:	5.0.2	Trust: 0.3
vendor:	lotus	model:	domino	scope:	eq	version:	5.0.1	Trust: 0.3
vendor:	lotus	model:	domino	scope:	ne	version:	5.0.7	Trust: 0.3

sources: CERT/CC: VU#676552 // CERT/CC: VU#601312 // CERT/CC: VU#642760 // CERT/CC: VU#555464 // BID: 2599 // CNNVD: CNNVD-200106-094 // NVD: CVE-2001-0412

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2001-0412
value:	HIGH
Trust: 1.0
CARNEGIE MELLON:	VU#676552
value:	10.50
Trust: 0.8
CARNEGIE MELLON:	VU#601312
value:	9.98
Trust: 0.8
CARNEGIE MELLON:	VU#642760
value:	10.50
Trust: 0.8
CARNEGIE MELLON:	VU#555464
value:	4.25
Trust: 0.8
CNNVD:	CNNVD-200106-094
value:	HIGH
Trust: 0.6
VULHUB:	VHN-3231
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2001-0412
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
VULHUB:	VHN-3231
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CERT/CC: VU#676552 // CERT/CC: VU#601312 // CERT/CC: VU#642760 // CERT/CC: VU#555464 // VULHUB: VHN-3231 // CNNVD: CNNVD-200106-094 // NVD: CVE-2001-0412

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2001-0412

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-200106-094

TYPE

access verification error

Trust: 0.6

sources: CNNVD: CNNVD-200106-094

EXTERNAL IDS

db:	OSVDB	id:	1784	Trust: 1.7
db:	BID	id:	2559	Trust: 1.7
db:	NVD	id:	CVE-2001-0412	Trust: 1.7
db:	BID	id:	2599	Trust: 1.1
db:	BID	id:	2571	Trust: 0.8
db:	XF	id:	6349	Trust: 0.8
db:	CERT/CC	id:	VU#676552	Trust: 0.8
db:	XF	id:	6347	Trust: 0.8
db:	BID	id:	2565	Trust: 0.8
db:	CERT/CC	id:	VU#601312	Trust: 0.8
db:	BID	id:	2598	Trust: 0.8
db:	XF	id:	6351	Trust: 0.8
db:	CERT/CC	id:	VU#642760	Trust: 0.8
db:	XF	id:	6350	Trust: 0.8
db:	CERT/CC	id:	VU#555464	Trust: 0.8
db:	CNNVD	id:	CNNVD-200106-094	Trust: 0.7
db:	XF	id:	6322	Trust: 0.6
db:	CISCO	id:	20010404 CISCO CONTENT SERVICES SWITCH USER ACCOUNT VULNERABILITY	Trust: 0.6
db:	VULHUB	id:	VHN-3231	Trust: 0.1

sources: CERT/CC: VU#676552 // CERT/CC: VU#601312 // CERT/CC: VU#642760 // CERT/CC: VU#555464 // VULHUB: VHN-3231 // BID: 2599 // CNNVD: CNNVD-200106-094 // NVD: CVE-2001-0412

REFERENCES

url:	http://www.securityfocus.com/advisories/3208	Trust: 3.2
url:	http://www.securityfocus.com/bid/2559	Trust: 1.7
url:	http://www.cisco.com/warp/public/707/arrowpoint-useraccnt-debug-pub.shtml	Trust: 1.7
url:	http://www.osvdb.org/1784	Trust: 1.7
url:	http://www.notes.net/r5fixlist.nsf/a8f0ffda1fc76c8985256752006aba6c?openview&start=3.111&count=30&expand=3.126#3.126	Trust: 1.6
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/6322	Trust: 1.1
url:	http://www.securityfocus.com/bid/2571	Trust: 0.8
url:	http://xforce.iss.net/static/6349.php	Trust: 0.8
url:	http://www.securityfocus.com/bid/2565	Trust: 0.8
url:	http://xforce.iss.net/static/6347.php	Trust: 0.8
url:	http://www.securityfocus.com/bid/2598	Trust: 0.8
url:	http://xforce.iss.net/static/6351.php	Trust: 0.8
url:	http://www.securityfocus.com/bid/2599	Trust: 0.8
url:	http://xforce.iss.net/static/6350.php	Trust: 0.8
url:	http://www.notes.net/r5fixlist.nsf/a8f0ffda1fc76c8985256752006aba6c/59719a1dd92c03e385256a4d0073766b?opendocument	Trust: 0.8
url:	http://xforce.iss.net/static/6322.php	Trust: 0.6
url:	http://www.lotus.com/home.nsf/welcome/domino	Trust: 0.3

CREDITS

This vulnerability was announced to Bugtraq in a Cisco Security Advisory dated April 4, 2001.

Trust: 0.6

sources: CNNVD: CNNVD-200106-094

SOURCES

db:	CERT/CC	id:	VU#676552
db:	CERT/CC	id:	VU#601312
db:	CERT/CC	id:	VU#642760
db:	CERT/CC	id:	VU#555464
db:	VULHUB	id:	VHN-3231
db:	BID	id:	2599
db:	CNNVD	id:	CNNVD-200106-094
db:	NVD	id:	CVE-2001-0412

LAST UPDATE DATE

2025-02-20T21:53:17.464000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#676552	date:	2001-07-26T00:00:00
db:	CERT/CC	id:	VU#601312	date:	2001-07-17T00:00:00
db:	CERT/CC	id:	VU#642760	date:	2001-07-17T00:00:00
db:	CERT/CC	id:	VU#555464	date:	2001-07-17T00:00:00
db:	VULHUB	id:	VHN-3231	date:	2017-10-10T00:00:00
db:	BID	id:	2599	date:	2001-04-11T00:00:00
db:	CNNVD	id:	CNNVD-200106-094	date:	2005-05-02T00:00:00
db:	NVD	id:	CVE-2001-0412	date:	2017-10-10T01:29:43.110

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#676552	date:	2001-07-23T00:00:00
db:	CERT/CC	id:	VU#601312	date:	2001-07-12T00:00:00
db:	CERT/CC	id:	VU#642760	date:	2001-07-12T00:00:00
db:	CERT/CC	id:	VU#555464	date:	2001-07-12T00:00:00
db:	VULHUB	id:	VHN-3231	date:	2001-06-18T00:00:00
db:	BID	id:	2599	date:	2001-04-11T00:00:00
db:	CNNVD	id:	CNNVD-200106-094	date:	2001-06-18T00:00:00
db:	NVD	id:	CVE-2001-0412	date:	2001-06-18T04:00:00