MDaemon WorldClient form2raw.cgi From buffer overflow

Added: 09/18/2006 CVE: CVE-2003-1200 BID: 9317 OSVDB: 3255 Background MDaemon is an e-mail server product for Windows. It includes a web mail component called WorldClient. Problem A buffer overflow in MDaemon WorldClient allows remote command execution by sending a web request for the form2raw.cg...

CVE-2006-4620

The usereditaccount.wdm module in Alt-N WebAdmin 3.2.5 running with MDaemon 9.0.6, and possibly earlier versions, allows remote authenticated domain administrators to gain privileges and obtain access to the system mail queue by modifying the mailbox of the MDaemon user account to use the mailbox...

CVE-2006-4620

The usereditaccount.wdm module in Alt-N WebAdmin 3.2.5 running with MDaemon 9.0.6, and possibly earlier versions, allows remote authenticated domain administrators to gain privileges and obtain access to the system mail queue by modifying the mailbox of the MDaemon user account to use the mailbox...

WebAdmin < 3.2.6 MDaemon Account Hijacking

The remote host is running WebAdmin, a web-based remote administration tool for Alt-N MDaemon. According to its banner, the installed version of WebAdmin enables a domain administrator within the default domain to hijack the 'MDaemon' account used by MDaemon when processing remote server and...

[Full-disclosure] TTG0602 - Alt-N WebAdmin MDaemon Account Hijacking

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TTG0602 - Alt-N WebAdmin MDaemon Account Hijacking RELEASE DATE: September 4, 2006 VENDOR: Alt-N Technologies http://www.altn.com VULNERABLE: Tested on Alt-N WebAdmin v3.2.5 running with MDaemon v9.0.6, earlier versions are suspected vulnerable as wel...

Alt-N Web Admini MDaemon account hijacking

Administrator of any mail domain can redirect any mail of "MDaemon" system account to any account...

CVE-2006-4364

Multiple heap-based buffer overflows in the POP3 server in Alt-N Technologies MDaemon before 9.0.6 allow remote attackers to cause a denial of service daemon crash and possibly execute arbitrary code via long strings that contain '@' characters in the 1 USER and 2 APOP commands...

mdaemon-user-py.txt

!/usr/bin/python import sys import struct import socket from time import sleep MDaemon Pre Authentication USER Heap Overflow Code based on Leon Juranic's exploit Coded by muts - [email protected] http://www.hackingdefined.com http://www.remote-exploit.org Tested on: Mdaemon 9.0.5 Mdaemon 7.2....

mdaemon_poc.txt

PoC for Mdaemon POP3 preauth heap overflow Coded by Leon Juranic Infigo IS $host = '192.168.0.105'; use IO::Socket; for $x = 0 ; $x $host,PeerPort = '110', Proto = 'tcp' || die "socket error\n\n"; recv $sock, $var, 10000,0; print $var; print $sock "USER " . "@A" x 160 . "\r\n"; recv $sock, $var,...

CVE-2006-4371

Multiple directory traversal vulnerabilities in Alt-N WebAdmin 3.2.3 and 3.2.4 running with MDaemon 9.0.5, and possibly earlier, allow remote authenticated global administrators to read arbitrary files via a .. dot dot in the file parameter to 1 logfileview.wdm and 2 configfileview.wdm...

CVE-2006-4370

Affected software / component: Alt-N WebAdmin (versions 3.2.3–3.2.4 with MDaemon 9.0.5; possibly earlier). Root cause / vulnerability: A flaw in WebAdmin’s handling of authentication/authorization via the userlist.wdm mechanism allows a remote authenticated domain administrator to change a global...

CVE-2006-4371

Multiple directory traversal vulnerabilities in Alt-N WebAdmin 3.2.3 and 3.2.4 running with MDaemon 9.0.5, and possibly earlier, allow remote authenticated global administrators to read arbitrary files via a .. dot dot in the file parameter to 1 logfileview.wdm and 2 configfileview.wdm...

Alt-N MDaemon POP3 Server 9.06 - USER Remote Heap Overflow

Alt-N MDaemon POP3 Server 9.06 - USER Remote Heap Overflow !/usr/bin/python import sys import struct import socket from time import sleep MDaemon Pre Authentication USER Heap Overflow Code based on Leon Juranic's exploit Coded by muts - [email protected] http://www.hackingdefined.com...

Alt-N MDaemon POP3 Server < 9.06 - 'USER' Remote Heap Overflow

!/usr/bin/python import sys import struct import socket from time import sleep MDaemon Pre Authentication USER Heap Overflow Code based on Leon Juranic's exploit Coded by muts - [email protected] http://www.hackingdefined.com http://www.remote-exploit.org Tested on: Mdaemon 9.0.5 Mdaemon 7.2....

MDaemon POP3 Server < 9.06 (USER) Remote Heap Overflow Exploit

Exploit for unknown platform in category remote exploits ============================================================== MDaemon POP3 Server 9.06 USER Remote Heap Overflow Exploit ============================================================== !/usr/bin/python import sys import struct import socket...

CVE-2006-4364

CVE-2006-4364 affects Alt-N Technologies’ MDaemon POP3 server prior to version 9.0.6. The vulnerability is due to multiple heap-based buffer overflows triggered by long strings containing '@' characters in the USER and APOP commands. Exploitation can cause a daemon crash (DoS) and may allow remot...

CVE-2006-4364

Multiple heap-based buffer overflows in the POP3 server in Alt-N Technologies MDaemon before 9.0.6 allow remote attackers to cause a denial of service daemon crash and possibly execute arbitrary code via long strings that contain '@' characters in the 1 USER and 2 APOP commands...

Alt-N MDaemon POP3 server buffer overflow

Buffer overflow on oversized username with '@' character in USER/APOP command...

TTG0601 - Alt-N WebAdmin Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TTG0601 - Alt-N WebAdmin Multiple Vulnerabilities RELEASE DATE: August 21st, 2006 VENDOR: Alt-N Technologies http://www.altn.com VULNERABLE: Tested on Alt-N WebAdmin v3.2.3/3.2.4 running with MDaemon v9.0.5, earlier versions are suspected vulnerable a...

MDaemon < 9.0.6 POP3 Server USER / APOP Command Remote Overflow

According to its banner, the POP3 server bundled with the version of MDaemon on the remote host has two buffer overflows that can be triggered with long arguments to the 'USER' and 'APOP' commands. By exploiting these issues, a remote, unauthenticated user can reportedly crash the affected servic...