Alt-N MDaemon IMAP server 9.6.4 - 'FETCH' Remote Buffer Overflow

!/usr/bin/python MDAEMON POST AUTH REMOTE R00T IMAP FETCH COMMAND UNIVERSAL EXPLOIT 0day Bug discovered and coded by Matteo Memelli aka ryujin http://www.gray-world.net http://www.be4mind.com Affected Versions : MDaemon IMAP server v9.6.4 Tested on OS : Windows 2000 SP4 English Windows XP Sp2...

mdaemon-overflow.txt

!/usr/bin/python MDAEMON POST AUTH REMOTE R00T IMAP FETCH COMMAND UNIVERSAL EXPLOIT 0day Bug discovered and coded by Matteo Memelli aka ryujin http://www.gray-world.net http://www.be4mind.com Affected Versions : MDaemon IMAP server v9.6.4 Tested on OS : Windows 2000 SP4 English Windows XP Sp2...

CVE-2003-1471

MDaemon POP server 6.0.7 and earlier allows remote authenticated users to cause a denial of service crash via a 1 DELE or 2 UIDL with a negative number...

CVE-2003-1470

The CVE concerns MDaemon IMAP Service with versions 6.7.5 and earlier. A buffer overflow is triggered in the IMAP CREATE command when a mailbox name is excessively long, allowing a remote authenticated user to crash the service and potentially execute arbitrary code. The descriptions consistently...

CVE-2003-1471

MDaemon POP server 6.0.7 and earlier is affected. The vulnerability allows remote authenticated users to cause a denial of service (crash) by issuing POP commands DELE or UIDL with a negative number. The connected documents confirm the affected product and the faulty commands but do not provide d...

CVE-2003-1470

Buffer overflow in IMAP service in MDaemon 6.7.5 and earlier allows remote authenticated users to cause a denial of service crash and execute arbitrary code via a CREATE command with a long mailbox name...

CVE-2003-1471: Improper Input Validation

MDaemon POP server 6.0.7 and earlier allows remote authenticated users to cause a denial of service crash via a 1 DELE or 2 UIDL with a negative number...

CVE-2003-1470: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in IMAP service in MDaemon 6.7.5 and earlier allows remote authenticated users to cause a denial of service crash and execute arbitrary code via a CREATE command with a long mailbox name...

MDaemon服务器DomainPOP消息拒绝服务漏洞

BUGTRAQ ID: 24787 MDaemon是一款基于Windows的邮件服务程序。 MDaemon的DomainPOP服务实现上存在漏洞，如果向MDaemon的DomainPOP发送了畸形消息的话，就可能导致服务崩溃。 Alt-N MDaemon 9.6 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.altn.com...

MDaemon Server DomainPOP Malformed Message DoS

According to its banner, the version of MDaemon installed on the remote host contains a vulnerability in its 'DomainPOP' Mail Collection component that may cause it to crash while processing a specially crafted message. An unauthenticated, remote attacker may be able to leverage this issue to den...

CVE-2007-3622

Unspecified vulnerability in DomainPOP in Alt-N Technologies MDaemon before 9.61 allows remote attackers to cause a denial of service crash via malformed messages...

CVE-2007-3622

CVE-2007-3622 affects Alt‑N Technologies MDaemon before 9.61, via the DomainPOP Mail Collection component. A malformed message may cause the server to crash, allowing a remote attacker to deny service to legitimate users (DoS). The issue is described as an unspecified vulnerability in DomainPOP; ...

CVE-2007-3622

Unspecified vulnerability in DomainPOP in Alt-N Technologies MDaemon before 9.61 allows remote attackers to cause a denial of service crash via malformed messages...

CVE-2007-3622: Undefined Security Weakness

Unspecified vulnerability in DomainPOP in Alt-N Technologies MDaemon before 9.61 allows remote attackers to cause a denial of service crash via malformed messages...

ALT-N MDaemon < 9.6.1 DomainPOP Malformed Message DoS

Binary data 4118.prm...

Alt-N MDaemon本地不安全默认目录权限漏洞

Alt-N MDaemon是一款基于Windows的邮件服务程序。 MDaemon在安装文件时没能设置正确的访问权限，本地攻击者可能利用此漏洞提升权限。 MDaemon默认下以不安全权限安装到了系统根目录的MDaemon文件夹中，允许Users组的成员创建文件和目录。本地攻击者可以通过将恶意的RASAPI32.DLL或MPRAPI.DLL库放置在MDaemon\APP目录中导致以系统权限执行任意代码。 Alt-N MDaemon 9.53 Alt-N MDaemon 9.51 Alt-N MDaemon 9.06 Alt-N MDaemon 9.0.5 临时解决方法：...

CVE-2006-5968

MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions Users create files/directories, which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemon\APP...

CVE-2006-5968

MDaemon 9.0.5, 9.0.6, 9.51, and 9.53 (and possibly other versions) install the MDaemon application folder with insecure permissions, allowing local users to create files/directories. This untrusted search path enables local code execution by placing malicious RASAPI32.DLL or MPRAPI.DLL in the MDa...

CVE-2006-5968

MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions Users create files/directories, which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemon\APP...

CVE-2006-5968: Undefined Security Weakness

MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions Users create files/directories, which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemon\APP...