Alt-N MDaemon < 13.0.4 Multiple Vulnerabilities

high Nessus Plugin ID 66634

Synopsis

A mail server on the remote Windows host is potentially affected by multiple vulnerabilities.

Description

The remote Windows host is running a version of Alt-N MDaemon that is earlier than 13.0.4. It is, therefore, potentially affected by the following vulnerabilities :

- An error exists related to the 'Strip X-Headers' setting that could allow the application to crash.
(Issue #10358)

- An input validation error exists related to displaying email body data that could allow cross-site scripting attacks. (Issue #10385)

- A weakness exists related to the generation of session IDs that could allow an attacker to hijack user sessions. (Issue #10386)

- An input validation error exists related to the 'Session' parameter that could allow an attacker to obtain encoded credential data. (Issue #10389)

- An input validation error exists related to 'WebAdmin' and account imports that could allow command execution.
(Issue #10390)

- An error exists related to the IMAP server that could allow plaintext command injection because the server does not properly switch from plaintext to ciphertext when handling the 'STARTTLS' command. (Issue #10452)

Solution

Upgrade to Alt-N MDaemon version 13.0.4 or later.

See Also

http://files.altn.com/mdaemon/release/relnotes_en.html

Plugin Details

Severity: High

ID: 66634

File Name: mdaemon_13_0_4.nasl

Version: 1.7

Type: remote

Agent: windows

Family: Windows

Published: 5/28/2013

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/a:alt-n:mdaemon

Required KB Items: mdaemon/installed

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/15/2013

Vulnerability Publication Date: 1/15/2013

Reference Information

BID: 58070, 58074, 58077, 58084, 58170, 58171

CWE: 20, 442, 629, 711, 712, 722, 725, 74, 750, 751, 79, 800, 801, 809, 811, 864, 900, 928, 931, 990