A vulnerability has been reported in IBM Lotus Domino, which can be exploited by malicious users to gain escalated privileges.

The vulnerability is caused due to an error in the agent signature verification that allowed some flags to be reused when an agent has been modified, effectively using the previously validated signature instead of a current invalid signature on the agent. This can be exploited to gain Full Access Administrator privileges by replacing the design of the database with a template that has a scheduled agent, which has been signed with a trusted and valid ID.

Successful exploitation requires designer or manager access to a database located on the Domino server.

Solution
Update to version Domino 6.5.6 Fix Pack 2 (FP2), Domino 7.0.2 Fix Pack 2 (FP2), Domino 7.0.3, or Domino 8.0.

Provided and/or discovered by
Reported to the vendor by a customer.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg21258784

Deep Links
Links available to Secunia VIM customers