Feeds

Lotus scrambles to repair security loophole

This Internet stuff is catching...

  • alert
  • submit to reddit

Build a business case: developing custom apps

Lotus is to rush out a security patch for Notes 4.6 client "within a month" after a leading independent lab published details of a security loophole in the software on the internet. Lotus officials played down the likelihood of the flaw being exploited, but said that it would be addressed in the Notes Release 5 upgrade, and in an interim patch. The patch, Notes 4.6 2A, will be available on the Lotus Web site. According to L0pht Heavy Industries, the Notes 4.6 client loophole is caused by a feature in the software that allows developers to preview Domino-based applications. In tests, L0pht claimed that hackers could misuse the preview feature to get unauthorised access to data. L0pht said that the loophole particularly affected sites that were using Notes as a development platform or as an intranet. Affected users, according to L0pht, are advised to manually edit the access control lists, and to set up routing filters to prevent access to the HTTP port of Notes client-only machines. L0pht, which comes out of a US hacking group, has previously listed a number of other security flaws in Lotus Notes, including the ability of Web users to write to remote server drives and change server configuration files.

Boost IT visibility and business value

More from The Register

next story
Kate Bush: Don't make me HAVE CONTACT with your iPHONE
Can't face sea of wobbling fondle implements. What happened to lighters, eh?
Video of US journalist 'beheading' pulled from social media
Yanked footage featured British-accented attacker and US journo James Foley
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
Ballmer leaves Microsoft board to spend more time with his b-balls
From Clippy to Clippers: Hi, I see you're running an NBA team now ...
Online tat bazaar eBay coughs to YET ANOTHER outage
Web-based flea market struck dumb by size and scale of fail
Amazon takes swipe at PayPal, Square with card reader for mobes
Etailer plans to undercut rivals with low transaction fee offer
Assange™: Hey world, I'M STILL HERE, ignore that Snowden guy
Press conference: ME ME ME ME ME ME ME (cont'd pg 94)
Call of Duty daddy considers launching own movie studio
Activision Blizzard might like quality control of a CoD film
US regulators OK sale of IBM's x86 server biz to Lenovo
Now all that remains is for gov't offices to ban the boxes
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.