Alt-N MDaemon < 13.0.4 Multiple Vulnerabilities
High Nessus Plugin ID 66634
SynopsisA mail server on the remote Windows host is potentially affected by multiple vulnerabilities.
DescriptionThe remote Windows host is running a version of Alt-N MDaemon that is earlier than 13.0.4. It is, therefore, potentially affected by the following vulnerabilities :
- An error exists related to the 'Strip X-Headers' setting that could allow the application to crash.
- An input validation error exists related to displaying email body data that could allow cross-site scripting attacks. (Issue #10385)
- A weakness exists related to the generation of session IDs that could allow an attacker to hijack user sessions. (Issue #10386)
- An input validation error exists related to the 'Session' parameter that could allow an attacker to obtain encoded credential data. (Issue #10389)
- An input validation error exists related to 'WebAdmin' and account imports that could allow command execution.
- An error exists related to the IMAP server that could allow plaintext command injection because the server does not properly switch from plaintext to ciphertext when handling the 'STARTTLS' command. (Issue #10452)
SolutionUpgrade to Alt-N MDaemon version 13.0.4 or later.