Critical severity · published Jun 7, 2017
CVE-2016-6087
IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key Exchange validation
9.8
CVSS
1.9%
EPSS
No
On KEV
Description
IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key Exchange validation. IBM X-Force ID: 117918.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Domino · Ibm
8.5.1.0; 8.5.1.1; 8.5.1.2; 8.5.1.3; 8.5.1.4; 8.5.1.5; +21 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6087
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6087
Patch
http://www.ibm.com/support/docview.wss?uid=swg22002808
Third Party Advisory
http://www.securityfocus.com/bid/98794
Third Party Advisory
http://www.securitytracker.com/id/1038606
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/117918
More from Domino
8.8
CVE-2017-1274
IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large…
8.1
CVE-2016-0304
The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is used, allows remote…
7.8
CVE-2012-6277
Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Security for Microsoft Exchange before 6.5.8, Symantec Mail Security for…
7.8
CVE-2018-1771
IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in the parsing of command line arguments passed to nsd.exe
7.8
CVE-2016-0301
Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a…