CVE-2018-1437: Critical severity IBM Notes vulnerability

Published Mar 14, 2018

Updated

IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. A local attacker could exploit this vulnerability to DLL hijacking to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 139565.

Affected Software

11 affected components

IBM Notes=8.5

IBM Notes=8.5.0.2

IBM Notes=8.5.1

IBM Notes=8.5.1.5

IBM Notes=8.5.2

IBM Notes=8.5.2.4

IBM Notes=8.5.3

IBM Notes=8.5.3.6

IBM Notes=9.0

IBM Notes=9.0.1

IBM Notes=9.0.1.9

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg22014201

Event History

Mar 14, 2018

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2018-1437?

CVE-2018-1437 is a vulnerability in IBM Notes 8.5 and 9.0 that allows an attacker to execute arbitrary code on the system.

How does CVE-2018-1437 work?

CVE-2018-1437 is caused by an error related to multiple untrusted search path, which allows a local attacker to exploit DLL hijacking to execute arbitrary code or crash the application.

What is the severity of CVE-2018-1437?

The severity of CVE-2018-1437 is critical with a CVSS score of 7.8.

Which versions of IBM Notes are affected by CVE-2018-1437?

IBM Notes versions 8.5, 8.5.0.2, 8.5.1, 8.5.1.5, 8.5.2, 8.5.2.4, 8.5.3, 8.5.3.6, 9.0, 9.0.1, and 9.0.1.9 are affected by CVE-2018-1437.

How can I fix CVE-2018-1437?

To fix CVE-2018-1437, update to a version of IBM Notes that is not affected by the vulnerability and apply any patches or security updates provided by IBM.