IBM patches Lotus Notes 1-2-3 security flaws

IBM has released a patch for highly critical security flaws in its Lotus Notes, following the discovery of vulnerabilities in a third-party software component used in Lotus 1-2-3.

Users who open a malicious file attachment can trigger a buffer overflow, as Lotus 1-2-3 tries to process the Lotus Worksheet file format. The vulnerabilities could allow a malicious attacker to take control of a user's system remotely and execute arbitrary code, according to Core Security Technologies, which issued a security advisory on Tuesday.

(Credit: IBM)

"Although these specific vulnerabilities exist on a third-party component, the problem is compounded by the way Lotus Notes displays information about attachments, making it easier to elicit unsuspecting assistance from the users to exploit them," Core Security's advisory notes.

Attackers, for example, could send a malicious Lotus 1-2-3 file attachment with a common extension of .jpg or .gif, rather than a MIME Content-type e-mail header.

Big Blue is advising customers to contact IBM support to receive the patch, which is available for Notes 7x and 8x client versions. The company also notes that the security flaws affect only Windows-based Notes clients. Lotus Domino server users are not affected.

Lotus Notes, which includes a combination of e-mail, instant messenger, browser and business collaboration applications, is a desktop client that is designed to work with Lotus Domino. Security researcher Secunia is rating the Lotus Notes vulnerabilities as "highly critical."