Detections
Analytics
Alt-N MDaemon < 13.0.4 Multiple Vulnerabilities
high Nessus Plugin ID 66634
Language:
Synopsis
A mail server on the remote Windows host is potentially affected by multiple vulnerabilities.Description
The remote Windows host is running a version of Alt-N MDaemon that is earlier than 13.0.4. It is, therefore, potentially affected by the following vulnerabilities :- An error exists related to the 'Strip X-Headers' setting that could allow the application to crash.
(Issue #10358)
- An input validation error exists related to displaying email body data that could allow cross-site scripting attacks. (Issue #10385)
- A weakness exists related to the generation of session IDs that could allow an attacker to hijack user sessions. (Issue #10386)
- An input validation error exists related to the 'Session' parameter that could allow an attacker to obtain encoded credential data. (Issue #10389)
- An input validation error exists related to 'WebAdmin' and account imports that could allow command execution.
(Issue #10390)
- An error exists related to the IMAP server that could allow plaintext command injection because the server does not properly switch from plaintext to ciphertext when handling the 'STARTTLS' command. (Issue #10452)
Solution
Upgrade to Alt-N MDaemon version 13.0.4 or later.See Also
Plugin Details
Severity: High
ID: 66634
File Name: mdaemon_13_0_4.nasl
Version: 1.7
Type: remote
Agent: windows
Family: Windows
Published: 5/28/2013
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:alt-n:mdaemon
Required KB Items: mdaemon/installed
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 1/15/2013
Vulnerability Publication Date: 1/15/2013