Sign-up

ID

VAR-200107-0160


CVE

CVE-2001-0428


TITLE

Lotus Domino vulnerable to DoS via crafted unicode GET request

Trust: 0.8

sources: CERT/CC: VU#676552

DESCRIPTION

Cisco VPN 3000 series concentrators before 2.5.2(F) allow remote attackers to cause a denial of service via an IP packet with an invalid IP option. The Lotus Domino Web Server contains a flaw that could be exploited to cause a denial of service. DIIOP by default listens on port 63148. Making continuous and unusually large connection requests to port 63148, will invoke a DIIOP session. Each such connection request will launch a new DIIOP session. Eventually this process will cause CPU utilization to spike to 100% on the target host. Cisco VPN 3000 Series Concentrator versions prior to 2.5.2(F) have a vulnerability

Trust: 3.42

sources: NVD: CVE-2001-0428 // CERT/CC: VU#676552 // CERT/CC: VU#601312 // CERT/CC: VU#555464 // BID: 2599 // VULHUB: VHN-3247

AFFECTED PRODUCTS

vendor:lotusmodel: - scope: - version: -

Trust: 2.4

vendor:ciscomodel:vpn 3000 concentrator series softwarescope:eqversion:2.5.2.c

Trust: 1.6

vendor:ciscomodel:vpn 3000 concentrator series softwarescope:eqversion:2.5.2.b

Trust: 1.6

vendor:ciscomodel:vpn 3000 concentrator series softwarescope:eqversion:2.5.2.a

Trust: 1.6

vendor:ciscomodel:vpn 3000 concentrator series softwarescope:eqversion:2.5.2.d

Trust: 1.6

vendor:ciscomodel:vpn 3000 concentratorscope:eqversion:2.5.2.a

Trust: 0.6

vendor:ciscomodel:vpn 3000 concentratorscope:eqversion:2.5.2.d

Trust: 0.6

vendor:ciscomodel:vpn 3000 concentratorscope:eqversion:2.5.2.c

Trust: 0.6

vendor:ciscomodel:vpn 3000 concentratorscope:eqversion:2.5.2.b

Trust: 0.6

vendor:lotusmodel:dominoscope:eqversion:5.0.6

Trust: 0.3

vendor:lotusmodel:dominoscope:eqversion:5.0.5

Trust: 0.3

vendor:lotusmodel:dominoscope:eqversion:5.0.4

Trust: 0.3

vendor:lotusmodel:dominoscope:eqversion:5.0.3

Trust: 0.3

vendor:lotusmodel:dominoscope:eqversion:5.0.2

Trust: 0.3

vendor:lotusmodel:dominoscope:eqversion:5.0.1

Trust: 0.3

vendor:lotusmodel:dominoscope:neversion:5.0.7

Trust: 0.3

sources: CERT/CC: VU#676552 // CERT/CC: VU#601312 // CERT/CC: VU#555464 // BID: 2599 // CNNVD: CNNVD-200107-021 // NVD: CVE-2001-0428

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2001-0428
value: MEDIUM

Trust: 1.0

CARNEGIE MELLON: VU#676552
value: 10.50

Trust: 0.8

CARNEGIE MELLON: VU#601312
value: 9.98

Trust: 0.8

CARNEGIE MELLON: VU#555464
value: 4.25

Trust: 0.8

CNNVD: CNNVD-200107-021
value: MEDIUM

Trust: 0.6

VULHUB: VHN-3247
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2001-0428
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-3247
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#676552 // CERT/CC: VU#601312 // CERT/CC: VU#555464 // VULHUB: VHN-3247 // CNNVD: CNNVD-200107-021 // NVD: CVE-2001-0428

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2001-0428

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200107-021

TYPE

unknown

Trust: 0.6

sources: CNNVD: CNNVD-200107-021

EXTERNAL IDS

db:NVDid:CVE-2001-0428

Trust: 1.7

db:OSVDBid:1786

Trust: 1.7

db:BIDid:2573

Trust: 1.7

db:BIDid:2599

Trust: 1.1

db:BIDid:2571

Trust: 0.8

db:XFid:6349

Trust: 0.8

db:CERT/CCid:VU#676552

Trust: 0.8

db:XFid:6347

Trust: 0.8

db:BIDid:2565

Trust: 0.8

db:CERT/CCid:VU#601312

Trust: 0.8

db:XFid:6350

Trust: 0.8

db:CERT/CCid:VU#555464

Trust: 0.8

db:CNNVDid:CNNVD-200107-021

Trust: 0.7

db:CISCOid:20010412 VPN 3000 CONCENTRATOR IP OPTIONS VULNERABILITY

Trust: 0.6

db:XFid:6360

Trust: 0.6

db:VULHUBid:VHN-3247

Trust: 0.1

sources: CERT/CC: VU#676552 // CERT/CC: VU#601312 // CERT/CC: VU#555464 // VULHUB: VHN-3247 // BID: 2599 // CNNVD: CNNVD-200107-021 // NVD: CVE-2001-0428

REFERENCES

url:http://www.securityfocus.com/advisories/3208

Trust: 2.4

url:http://www.securityfocus.com/bid/2573

Trust: 1.7

url:http://www.cisco.com/warp/public/707/vpn3k-ipoptions-vuln-pub.shtml

Trust: 1.7

url:http://www.osvdb.org/1786

Trust: 1.7

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/6360

Trust: 1.1

url:http://www.securityfocus.com/bid/2571

Trust: 0.8

url:http://xforce.iss.net/static/6349.php

Trust: 0.8

url:http://www.securityfocus.com/bid/2565

Trust: 0.8

url:http://xforce.iss.net/static/6347.php

Trust: 0.8

url:http://www.notes.net/r5fixlist.nsf/a8f0ffda1fc76c8985256752006aba6c?openview&start=3.111&count=30&expand=3.126#3.126

Trust: 0.8

url:http://www.securityfocus.com/bid/2599

Trust: 0.8

url:http://xforce.iss.net/static/6350.php

Trust: 0.8

url:http://www.notes.net/r5fixlist.nsf/a8f0ffda1fc76c8985256752006aba6c/59719a1dd92c03e385256a4d0073766b?opendocument

Trust: 0.8

url:http://xforce.iss.net/static/6360.php

Trust: 0.6

url:http://www.lotus.com/home.nsf/welcome/domino

Trust: 0.3

sources: CERT/CC: VU#676552 // CERT/CC: VU#601312 // CERT/CC: VU#555464 // VULHUB: VHN-3247 // BID: 2599 // CNNVD: CNNVD-200107-021 // NVD: CVE-2001-0428

CREDITS

Discovered and posted to Bugtraq by <peter.grundl@defcom.com> on April 11, 2001.

Trust: 0.3

sources: BID: 2599

SOURCES

db:CERT/CCid:VU#676552
db:CERT/CCid:VU#601312
db:CERT/CCid:VU#555464
db:VULHUBid:VHN-3247
db:BIDid:2599
db:CNNVDid:CNNVD-200107-021
db:NVDid:CVE-2001-0428

LAST UPDATE DATE

2026-02-08T22:28:38.937000+00:00


SOURCES UPDATE DATE

db:CERT/CCid:VU#676552date:2001-07-26T00:00:00
db:CERT/CCid:VU#601312date:2001-07-17T00:00:00
db:CERT/CCid:VU#555464date:2001-07-17T00:00:00
db:VULHUBid:VHN-3247date:2018-10-30T00:00:00
db:BIDid:2599date:2001-04-11T00:00:00
db:CNNVDid:CNNVD-200107-021date:2005-05-02T00:00:00
db:NVDid:CVE-2001-0428date:2025-04-03T01:03:51.193

SOURCES RELEASE DATE

db:CERT/CCid:VU#676552date:2001-07-23T00:00:00
db:CERT/CCid:VU#601312date:2001-07-12T00:00:00
db:CERT/CCid:VU#555464date:2001-07-12T00:00:00
db:VULHUBid:VHN-3247date:2001-07-02T00:00:00
db:BIDid:2599date:2001-04-11T00:00:00
db:CNNVDid:CNNVD-200107-021date:2001-07-02T00:00:00
db:NVDid:CVE-2001-0428date:2001-07-02T04:00:00