While doing a vulnerability assessment and hardening of our servers, the Foundstone tool found this vulnerability on our Lotus Domino 5 server that we need to remediate:
----------------------------------------------------------
Name
Lotus Domino Webserver Administration Databases Disclosure
Risk
6
Intrusive
No
Description
An information disclosure vulnerability in Lotus Domino Server provides sensitive information regarding the target host.
Observation
Lotus Domino is an Application server designed to aid workgroups. It offers SMTP, POP3, IMAP, LDAP and Web services that allow users to interact with Lotus Notes databases.
Default installations of Lotus Domino include administrative database files which can be accessed anonymously. These files contain sensitive information regarding users, server configuration, access logs and operating system information.
The administrative database files are:
log.nsf,
domlog.nsf
catalog.nsf
mab.nsf
agentrunner.nsf
mtatbls.nsf
setup.nsf
mail.box
events4.nsf
admin4.nsf
An attacker could use GET html forms to access these database files and retrieve sensitive information regarding the target host.
Vulnerable Systems:
Lotus Domino 4.x, 5.x, 6.x
Recommendation
Currently no vendor-supplied patches are available for this issue.
Workaround:
Default installations of Lotus Domino may allow anonymous access to administrative database files. To fix this problem, verify the permissions for these databases and restrict access to only those accounts that need it.
----------------------------------------------------------
I've modified the ACLs and removed all Anonymous access capabilites from every database file and a recent scan still detects this as a vulnerability.
Looking for any tips and suggestions that will help me resolve this issue.
Thanks
Print this page
