CVE-2007-5701

Incomplete blacklist vulnerability in the Certificate Authority (CA) in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information (passwords) when an administrator enters a "ca activate" or "ca unlock" command with any uppercase character, which bypasses a blacklist designed to suppress password logging, resulting in cleartext password disclosure in the console log and Admin panel.

Link	Resource
http://www-1.ibm.com/support/docview.wss?uid=swg21261095	Patch
http://www.securityfocus.com/bid/26176	Patch
http://secunia.com/advisories/27321	Patch Vendor Advisory
http://osvdb.org/40952
http://www.vupen.com/english/advisories/2007/3598
https://exchange.xforce.ibmcloud.com/vulnerabilities/37372

Configuration 1

cpe:2.3:a:ibm:lotus_domino:7.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:lotus_domino:6.5.5:*:fp3:*:*:*:*:* cpe:2.3:a:ibm:lotus_domino:6.5.6:*:fp1:*:*:*:*:* cpe:2.3:a:ibm:lotus_domino:6.5.6:*:*:*:*:*:*:* cpe:2.3:a:ibm:lotus_domino:6.5.5:*:fp2:*:*:*:*:* cpe:2.3:a:ibm:lotus_domino:7.0.2:*:fp2:*:*:*:*:* cpe:2.3:a:ibm:lotus_domino:7.0.2:*:fp1:*:*:*:*:* cpe:2.3:a:ibm:lotus_domino:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:lotus_domino:6.5.5:*:*:*:*:*:*:* cpe:2.3:a:ibm:lotus_domino:6.5.5:*:fp1:*:*:*:*:*

---

Published : 2007-10-29 09:46

Updated : 2017-07-29 01:33

---

NVD link : CVE-2007-5701

Mitre link : CVE-2007-5701

No products.

CWE-200

CWE-310