CVE-1999-1012: Medium severity Lotus Domino vulnerability
SMTP component of Lotus Domino 4.6.1 on AS/400, and possibly other operating systems, allows a remote attacker to crash the mail server via a long string.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If SMTP is not required, disable the Domino SMTP service on affected servers to prevent remote exploitation via specially crafted long input strings.
IBM Lotus Domino SMTP component SMTP service = disabled - Compensating control
Block or restrict access to the Domino SMTP service (TCP port 25) from untrusted networks using firewall rules, network ACLs, or network segmentation so remote attackers cannot reach the SMTP component.
- Operational
Monitor Domino mail servers for crashes or abnormal behavior and apply any vendor-provided patch or update addressing this SMTP crash vulnerability as soon as it becomes available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1012?
CVE-1999-1012 is considered a critical vulnerability as it allows a remote attacker to crash the mail server.
How do I fix CVE-1999-1012?
To fix CVE-1999-1012, ensure that you upgrade your Lotus Domino to a more secure version that addresses this vulnerability.
Which systems are affected by CVE-1999-1012?
CVE-1999-1012 specifically affects Lotus Domino version 4.6.1 on AS/400 systems.
What does CVE-1999-1012 exploit?
CVE-1999-1012 exploits the SMTP component of Lotus Domino by sending a long string to the mail server.
Is CVE-1999-1012 still relevant today?
Although CVE-1999-1012 is quite old, systems still running Lotus Domino 4.6.1 may remain vulnerable if not updated.