Unscored severity · published Dec 27, 2007
CVE-2007-4474
Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, inotes6w.dll, dwa7.dll, and dwa7w.dll, in Domino 6.x and 7.x…
–
CVSS
44.2%
EPSS
No
On KEV
Description
Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, inotes6w.dll, dwa7.dll, and dwa7w.dll, in Domino 6.x and 7.x allow remote attackers to execute arbitrary code, as demonstrated by an overflow from a long General_ServerName property value when calling the InstallBrowserHelperDll function in the Upload Module in the dwa7.dwa7.1 control in dwa7w.dll 7.0.34.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)44.2% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DW
Domino Web Access · Ibm
6.0; 6.0.1; 6.0.1.1; 6.0.2; 6.0.3; 6.0.4; +9 more · source: NVD
LD
Lotus Domino Web Access · Ibm
7.0.1; 7.0.34.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4474
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4474
Exploit
http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059233.html
osvdb.org
http://osvdb.org/40954
Vendor Advisory
http://secunia.com/advisories/28184
US Government Resource
http://www.kb.cert.org/vuls/id/963889
Exploit
http://www.securityfocus.com/bid/26972
www.securitytracker.com
http://www.securitytracker.com/id?1019138
More from Domino Web Access
–
CVE-2010-0919
Stack-based buffer overflow in the Lotus Domino Web Access ActiveX control in IBM Lotus iNotes (aka Domino Web Access or DWA) 6.5, 7.0 before 7.0.4, 8.0, 8.0.2, and before 229.281…
–
CVE-2010-0276
IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.241 for Domino 8.0.2 FP3 does not properly handle navigation of the "Try Lotus iNotes anyway" link from the page that…
–
CVE-2009-3105
Cross-site scripting (XSS) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 211.241 for Domino 8.0.1 allows remote attackers to inject arbitrary web script…