Multiple stack-based buffer overflows in Autonomy (formerly Verity) KeyView Viewer, Filter, and Export SDK before 9.2.0.12, as used by ActivePDF DocConverter, IBM Lotus Notes before 7.0.3, Symantec Mail Security, and other products, allow remote attackers to execute arbitrary code via a crafted (1) AG file to kpagrdr.dll, (2) AW file to awsr.dll, (3) DLL or (4) EXE file to exesr.dll, (5) DOC file to mwsr.dll, (6) MIF file to mifsr.dll, (7) SAM file to lasr.dll, or (8) RTF file to rtfsr.dll. NOTE: the WPD (wp6sr.dll) vector is covered by CVE-2007-5910.

The version of Lotus Notes installed on the remote Windows host is reportedly affected by several buffer overflows in its file attachment viewer when handling attachments of various types.  By sending a specially crafted attachment to users of the affected application and getting them to double-click and view the attachment, an attacker may be able to execute arbitrary code subject to the privileges under which the affected application runs. 

It is also affected by another buffer overflow vulnerability in the TagAttributeListCopy function in ''nnotes.dll'' that could be triggered when a specially crafted message is replied to, forwarded, or copied to the clipboard by a user of the application.

The remote host is running the Lotus Notes email client. The reported version is older than 7.0.3.  This version of Lotus Notes is reported vulnerable to multiple remote buffer overflows.  The specific flaw seems to be in the portion of the application that processes attachments.  In order for this attack vector to be utilized, the attacker would need to be able to entice a Lotus Notes user into opening a malicious attachment.  Successful exploitation would result in the attacker executing arbitrary code on the remote system.

The remote host is running a version of Lotus Domino Server that is prone to multiple attacks against the web server component.  An attacker exploiting these flaws would be able to either view confidential data or execute arbitrary code via a buffer overflow.

ID	Name	Product	Family	Severity
27534	Lotus Notes Client < 7.0.3 / 8.0.1 Multiple Overflows	Nessus	Windows	high
4262	Lotus Notes < 7.0.3 HTML Email RTF Conversion Overflow	Nessus Network Monitor	SMTP Clients	critical
4261	Lotus Domino Multiple Vulnerabilities	Nessus Network Monitor	SMTP Servers	critical

Detections

Analytics

CVE-2007-5909

high

Tenable Plugins

high

critical

critical