dbcve.org
Lotus QuickrApplication · Ibm

CVE-2012-2176

HIGH · 9.3 CVSS v2.0 Published 2012-05-25
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to execute arbitrary code via a long argument to the (1) Attachment_Times or (2) Import_Times method.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Stack-based buffer overflows exist in the qp2.cab ActiveX control for IBM Lotus Quickr 8.2 (before 8.2.0.27-002a). Remote attackers can achieve arbitrary code execution by supplying excessively long arguments to the Attachment_Times or Import_Times methods, overwriting stack memory and redirecting execution flow.

MitigationApply IBM Lotus Quickr 8.2.0.27-002a or later which patches the vulnerable ActiveX control. As an interim measure, disable the qp2.cab ActiveX control in Internet Explorer or set the ActiveX kill bit to prevent instantiation.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Lotus QuickrApplication
Affected:= 8.2

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
M
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Verify IBM Lotus Quickr 8.2 installation
    Check for IBM Lotus Quickr installation by looking in the Windows registry under HKLM\SOFTWARE\IBM\Lotus\Quickr or by checking the program files directory (typically C:\Program Files\IBM\Lotus\Quickr). The product is typically installed as a Windows service and web application.
    Affected if Lotus Quickr 8.2 is installed on the system
  2. Check installed Quickr version number
    Locate the version information in the Windows registry at HKLM\SOFTWARE\IBM\Lotus\Quickr\Version or check the file version of qp2.cab in the Quickr installation directory. The file qp2.cab is typically found in the connectors or plugins subfolder.
    Affected if The installed version is 8.2.x but earlier than 8.2.0.27-002a
  3. Confirm qp2.cab ActiveX control presence
    Check for the qp2.cab file in the Quickr installation directory. Additionally, verify the ActiveX control is registered in the Windows registry under HKCR\CLSID for the CLSID associated with qp2.cab (typically {7E4E2D81-3B6B-4F3A-8B8C-1D7A5F2E6A9C} or similar IBM CLSID).
    Affected if The qp2.cab ActiveX control file exists and is registered in the system
  4. Check if ActiveX control can instantiate in Internet Explorer
    Open Internet Explorer and attempt to navigate to a Quickr server or check if the qp2.cab control loads. In IE, go to Tools > Manage Add-ons and look for the Quickr qp2.cab ActiveX control in the list of currently loaded add-ons.
    Affected if The qp2.cab ActiveX control appears as an enabled add-on in Internet Explorer and is loadable by the browser

A system is affected if IBM Lotus Quickr 8.2 is installed with a version earlier than 8.2.0.27-002a and the qp2.cab ActiveX control is present and can be instantiated in Internet Explorer.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply IBM Lotus Quickr 8.2.0.27-002a or later which patches the vulnerable ActiveX control. As an interim measure, disable the qp2.cab ActiveX control in Internet Explorer or set the ActiveX kill bit to prevent instantiation.

Recommended fix High confidence

IBM Lotus Quickr 8.2.0.27-002a for Domino

  1. 1. Identify the current IBM Lotus Quickr version installed by checking the About section in the Lotus Quickr administrator console or using the version information in the installation directory.
  2. 2. If the installed version is before 8.2.0.27-002a, download the IBM Lotus Quickr 8.2.0.27-002a fix from IBM Fix Central (https://www-945.ibm.com/support/fixcentral/) or the IBM Support Portal.
  3. 3. Back up the current Lotus Quickr installation, including the data directory and configuration files, before applying any updates.
  4. 4. Apply the 8.2.0.27-002a fix following the IBM-provided installation instructions specific to your deployment (Domino platform).
  5. 5. After installation, verify the version has been updated to 8.2.0.27-002a or later.
  6. 6. Test the Attachment_Times and Import_Times methods to confirm the ActiveX control functions correctly with the patch applied.
  7. 7. As a temporary mitigation before patching, disable the affected ActiveX control (qp2.cab) in Internet Explorer by adding it to the Windows ActiveX kill bit or using Group Policy to restrict its execution.
Caveat Review IBM release notes for 8.2.0.27-002a to check for any configuration or compatibility changes that may require adjustment during the upgrade process.

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Lotus Quickr Scoped from the published advisory
  • Consultation2.0 h
  • Implementation1.0 h
  • Testing4.0 h
  • Review / QA2.0 h
9.0 hours of engineering $1,540
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,464.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2012-2176 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2012-2176 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data