A vulnerability has been reported in IBM Lotus Quickr for Domino, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error within the qp2.cab ActiveX control and can be exploited to cause a stack-based buffer overflow via a call to the "Attachment_Times()" or "Import_Times()" method with an overly long argument.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in IBM Lotus Quickr for Domino version 8.2. Prior versions may also be affected.

Solution
Apply hot fix.

Provided and/or discovered by
Gaurav Baruah, eSecForte Technologies via ZDI.

Changelog
Further details available to Secunia VIM customers

Original Advisory
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21596191

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-12-134/

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers