The CERT Coordination Center on Wednesday issued an alert confirming several buffer overflow vulnerabilities in Lotus Notes and Domino that could lead to denial-of-service scenarios.

Systems affected by the bugs include Lotus Notes and Domino versions prior to 5.0.12 and 6.0 Gold. Download locations for vendor patches can be found within the CERT advisory.

The Center confirmed buffer overflow vulnerabilities in Lotus iNotes and Lotus Domino Web Server which leaves unpatched systems open to DoS attacks. One of those Lotus iNotes flaws, described as "critical" by NGSS, can be exploited by an attacker to run code in the security context of the account running the Domino Web Services.

The Center also issued a clarification for another vulnerability originally reported in an iNotes ActiveX control. "The vulnerable code is not specific to iNotes or ActiveX," CERT/CC said, noting that the iNotes ActiveX control was an attack vector for the vulnerability and is not the affected code base.

"Because this issue is not specific to ActiveX, Lotus Notes clients and Domino Servers running on platforms other than Microsoft Windows may be affected," it warned.

Security research firm Rapid7 also found several holes in Lotus Domino prior to version 5.0.12. It said the Lotus Domino Server was susceptible to a pre-authentication buffer overflow during Notes authentication. The Lotus Domino Web Retriever also contained a buffer overflow vulnerability.

Rapid7 also warned of holes in Lotus Domino pre-release and beta versions of 6.0 were also affected by multiple vulnerabilities in LDAP handling code. "The impact of these vulnerabilities range from denial of service to data corruption and the potential to execute arbitrary code," the Center warned.

It noted that patches are available only for some of the vulnerabilities. Until patches are made available for all, IT administrators are encouraged to block access from outside the network perimeter or configure Lotus Notes to help mitigate successful exploitation of the flaws.