{"id":"CVE-2017-1274","published":"2017-04-25T18:00:00Z","modified":"2024-08-05T13:25:17Z","title":"IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an…","vendor":"IBM","product":"Domino","tier":"core","eol":null,"affectedVersions":[{"vendor":"IBM","product":"Domino","versions":["8.5.3.5, 8.5.3.6, 9.0.1, 8.5, 9.0, 8.5.1, 8.5.2, 8.5.3, 9.0.1.1, 8.0.2, 8.0, 8.0.1, 8.5.1.5, 8.5.2.4, 9.0.1.2, 8.5.0.1, 9.0.1.3, 8.5.1.4, 9.0.1.4, 9.0.1.5, 8.5.1.1, 9.0.1.6, 9.0.1.7, 9.0.1.8"]}],"description":{"text":"IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM X-Force ID: 124749.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.06736,"percentile":0.93929,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2017-03-20","exploitedFirstSeen":"2017-03-20","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2017-03-20"},{"url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=a9c54f79-d780-437b-a7f5-a74960e299d5&CommunityKey=8af7f28f-02f1-4107-8639-93a60b6546d4&tab=librarydocuments","date":"2017-06-20"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.ibm.com/support/docview.wss?uid=swg22002280","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/97910","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securityfocus.com/bid/98019","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securitytracker.com/id/1038358","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://www.kb.cert.org/vuls/id/676632","tags":["third-party-advisory","x_refsource_CERT-VN"]},{"url":"http://packetstormsecurity.com/files/152786/Lotus-Domino-8.5.3-EXAMINE-Stack-Buffer-Overflow.html","tags":["x_refsource_MISC"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-10290","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-10290","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46808,"url":"https://www.exploit-db.com/exploits/46808","title":"Lotus Domino 8.5.3 - 'EXAMINE' Stack Buffer Overflow DEP/ASLR Bypass (NSA's EMPHASISMINE)","type":"remote","platform":"windows","date":"2019-05-08","verified":false,"provenance":"source"},{"id":46808,"url":"https://www.exploit-db.com/exploits/46808","title":"Lotus Domino 8.5.3 - 'EXAMINE' Stack Buffer Overflow DEP/ASLR Bypass (NSA's EMPHASISMINE)","type":"remote","platform":"windows","date":"2019-05-08","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2019-05-08"},"first":{"date":"2019-05-08","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/46808"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/152786/Lotus-Domino-8.5.3-EXAMINE-Stack-Buffer-Overflow.html"],"flow":[{"stage":"related","techniques":["T1068"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2017-03-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2017-04-25","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2017-1274","provenance":"source"},{"date":"2019-05-08","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-46808)","url":"https://www.exploit-db.com/exploits/46808","provenance":"source"}],"speed":{"daysToPublicExploit":743,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":58.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3510 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.79,"detail":"percentile 0.9393"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 Exploit-DB entries; 1 NVD exploit link"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}