Authentication is not required to exploit this vulnerability.
The flaw exists within the remote console functionality which listens by default on TCP port 2050. When handling A user authentication the server uses a user supplied COOKIEFILE path to retrieve stored credentials. The application then compares this data against the user provided username and cookie. The path to the COOKIEFILE can be a UNC path allowing the attacker to control both the known good credentials and the challenge credentials. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
Workaround:
Setting a console password provides another level of authentication and limits the commands available in the console. To further mitigate this vulnerability access to 2050/tcp on hosts running the Domino Server Controller application should be restricted to authorized hosts.
Disclosure Timeline:
2010-09-23 - Vulnerability reported to vendor
2011-03-22 - Coordinated public release of advisory
