CVE-2006-5835: Medium severity IBM Lotus Notes vulnerability
Published Nov 10, 2006
·Updated
The Notes Remote Procedure Call (NRPC) protocol in IBM Lotus Notes Domino before 6.5.5 FP2 and 7.x before 7.0.2 does not require authentication to perform user lookups, which allows remote attackers to obtain the user ID file.
Affected Software
16 affected components
IBM Lotus Notes=5.0.3
IBM Lotus Notes=5.0.12
IBM Lotus Notes=6.0
IBM Lotus Notes=6.0.1
IBM Lotus Notes=6.0.2
IBM Lotus Notes=6.0.3
IBM Lotus Notes=6.0.4
IBM Lotus Notes=6.0.5
IBM Lotus Notes=6.5
IBM Lotus Notes=6.5.1
IBM Lotus Notes=6.5.2
IBM Lotus Notes=6.5.3
IBM Lotus Notes=6.5.4
IBM Lotus Notes=6.5.5
IBM Lotus Notes=7.0
IBM Lotus Notes=7.0.1
Remediation
Patch Available
Event History
Nov 10, 2006
CVE Published
01:07 AM
Data Sourced
via NVD·01:07 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-5835?
CVE-2006-5835 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2006-5835?
To fix CVE-2006-5835, upgrade to IBM Lotus Notes Domino version 6.5.5 FP2 or 7.0.2 or later.
3
What type of attack does CVE-2006-5835 enable?
CVE-2006-5835 allows remote attackers to perform user lookups without authentication, potentially exposing user ID files.
4
Which versions of IBM Lotus Notes are affected by CVE-2006-5835?
CVE-2006-5835 affects IBM Lotus Notes versions prior to 6.5.5 FP2 and 7.x versions before 7.0.2.
5
Is user authentication required for the NRPC protocol affected by CVE-2006-5835?
No, the NRPC protocol in the affected versions of IBM Lotus Notes does not require authentication for user lookups.