Unscored severity · published Nov 10, 2006
CVE-2006-5835
The Notes Remote Procedure Call (NRPC) protocol in IBM Lotus Notes Domino before 6.5.5 FP2 and 7.x before 7.0.2 does not require authentication to perform user lookups, which…
–
CVSS
13.4%
EPSS
No
On KEV
Description
The Notes Remote Procedure Call (NRPC) protocol in IBM Lotus Notes Domino before 6.5.5 FP2 and 7.x before 7.0.2 does not require authentication to perform user lookups, which allows remote attackers to obtain the user ID file.
Exploitation
Is it being used?
Exploit prediction (EPSS)13.4% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LN
Lotus Notes · Ibm
5.0.3; 5.0.12; 6.0; 6.0.1; 6.0.2; 6.0.3; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-5835
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-5835
Patch
http://secunia.com/advisories/22741
securitytracker.com
http://securitytracker.com/id?1017203
Patch
http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21248026
Exploit
http://www.fortconsult.net/images/pdf/lotusnotes_keyfiles.pdf
www.securityfocus.com
http://www.securityfocus.com/bid/20960
www.vupen.com
http://www.vupen.com/english/advisories/2006/4411
More from Lotus Notes
7.8
CVE-2007-5544
IBM Lotus Notes before 6.5.6, and 7.x before 7.0.3; and Domino before 6.5.5 FP3, and 7.x before 7.0.2 FP1; uses weak permissions (Everyone:Full Control) for memory mapped files…
7.0
CVE-2013-0522
The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allows local users to discover passwords via vectors involving…
–
CVE-2014-3086
Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other products, allows remote attackers to gain…
–
CVE-2014-0892
IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options, which makes it easier for remote attackers to execute…
–
CVE-2012-6349
Buffer overflow in the .mdb parser in Autonomy KeyView IDOL, as used in IBM Notes 8.5.x before 8.5.3 FP4, allows remote attackers to execute arbitrary code via a crafted file, aka…