Rapid7 Vulnerability & Exploit Database

Lotus Notes/Domino Anonymous Access to Trend Micro ScanMail Configuration Database

Back to Search

Lotus Notes/Domino Anonymous Access to Trend Micro ScanMail Configuration Database

Severity
6
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:N)
Published
11/01/2004
Created
07/25/2018
Added
11/01/2004
Modified
07/19/2012

Description

The Domino server has been configured to allow anonymous access to the ScanMail Configuration Database (/smconf.nsf). This database is used by TrendMicro's ScanMail for Lotus Notes to administer and configure the ScanMail task. An attacker could use this database to control, disable, or modify the ScanMail task and its related configuration data. An attacker could disable the ScanMail task and then send viruses or trojan horses through via email to unsuspecting users. Additionally, an attacker can obtain your ScanMail serial number and contact information from this database. Under no circumstances should non-Administrative users have access to this database.

Solution(s)

  • disable-anonymous-default-notes-acl

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;