A remote overflow exists in Lotus Domino Sametime Server. The Multiplexer StMux.exe in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, fails to restrict string lengths in a POST request resulting in a stack based buffer overflow. With a specially crafted request, an attacker can execute arbitrary code resulting in a loss of confidentiality, integrity, and/or availability.

Upgrade to version 8.0.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2008-2499 (see also: NVD)
• Bugtraq ID: 29328
• Secunia Advisory ID: 30309
• Metasploit ID: 45610
• VUPEN Advisory: ADV-2008-1595
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2008-05/0282.html
• Generic Exploit URL: http://d2sec.com/products.htm
  http://metasploit.com/svn/framework3/trunk/modules/exploits/windows/lotus/domino_sametime_stmux.rb
  http://www.saintcorporation.com/cgi-bin/exploit_info/lotus_sametime_multiplexer
• Vendor Specific News/Changelog Entry: http://www-1.ibm.com/support/docview.wss?uid=swg21303920
• Other Advisory URL: http://www.zerodayinitiative.com/advisories/ZDI-08-028/

• Manuel Santamarina Suarez - Zero Day Initiative (ZDI)