Alt-N MDaemon < 13.0.4 Multiple Vulnerabilities

This script is Copyright (C) 2013-2016 Tenable Network Security, Inc.


Synopsis :

A mail server on the remote Windows host is potentially affected by
multiple vulnerabilities.

Description :

The remote Windows host is running a version of Alt-N MDaemon that is
earlier than 13.0.4. It is, therefore, potentially affected by the
following vulnerabilities :

- An error exists related to the 'Strip X-Headers'
setting that could allow the application to crash.
(Issue #10358)

- An input validation error exists related to displaying
email body data that could allow cross-site scripting
attacks. (Issue #10385)

- A weakness exists related to the generation of session
IDs that could allow an attacker to hijack user
sessions. (Issue #10386)

- An input validation error exists related to the
'Session' parameter that could allow an attacker to
obtain encoded credential data. (Issue #10389)

- An input validation error exists related to 'WebAdmin'
and account imports that could allow command execution.
(Issue #10390)

- An error exists related to the IMAP server that could
allow plaintext command injection because the server
does not properly switch from plaintext to ciphertext
when handling the 'STARTTLS' command. (Issue #10452)

See also :

http://files.altn.com/mdaemon/release/relnotes_en.html

Solution :

Upgrade to Alt-N MDaemon version 13.0.4 or later.

Risk factor :

High / CVSS Base Score : 9.0
(CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS Temporal Score : 7.0
(CVSS2#E:POC/RL:OF/RC:C)
Public Exploit Available : true

Family: Windows

Nessus Plugin ID: 66634 ()

Bugtraq ID: 58070
58074
58077
58084
58170
58171

CVE ID:

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now