09 November 2006, 12:29

Rights elevation in Lotus Domino for Linux

Local users can achieve root rights in IBM's Lotus Domino. This error is based on liberally set rights for the tunekrnl application, through which Lotus Domino can modify the kernel's resource limits. tunekrnl belongs to the root administrator and has the set-user-id bit set.

Because of a lack of length verification for user input in tunekrnl, which is copied into a fixed-size buffer, skillful local users could plant arbitrary program code and execute it with root rights.

The flaw affects Domino 6.x and 7.0.x from the zSeries Linux as well as Domino 7.0.x for Linux on x86 architecture. IBM has removed the flaw in Domino versions 6.5.5 Fix Pack 2 and Domino 7.0.2. Users who cannot switch to the new version can alternatively rename or delete tunekrnl or remove its setuid bit.