def-2000-03: MDaemon 3.5.0 DoS

====================================================================== Defcom Labs Advisory def-2000-03 MDaemon 3.5.0 DoS Author: Peter Grьndl [email protected] Release Date: 2000-12-19 ====================================================================== ------------------------=Brief...

Possible DOS on MDConfig (MDaemon)

MDaemon mail server for Windows comes with a utility called MDConfig to remotely administer a MDaemon server. To establish MDConfig connection to a MDaemon server, an administrator must enable MDConfig server on the server machine. Connection will be established on a predefined TCP port, by defau...

Bypass MDaemon 3.5.1 "Lock Server" Protection

Ok, This is my second post in the years and I have been reading all your postings so far. You all are doing a great job indeed. I would like to point out a security problem in MDaemon mail server even in ver 3.5.1 the latest. My setup: Windows NT 4.0 server SP 6.0a MDaemon Pro ver 3.5.1 The lates...

Уязвимость локальной защиты в MDaemon

Локальную функцию блокировки программы паролем можно легко обойти...

CVE-2000-1020

Heap overflow in Worldclient in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL...

CVE-2000-1021

Heap overflow in WebConfig in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL...

CVE-2000-1021

CVE-2000-1021 describes a heap overflow in the WebConfig component of Mdaemon ≤ 3.1.1. The vulnerability allows remote attackers to cause a denial of service and potentially execute arbitrary commands by supplying a long URL. Exploitation details are not provided in the available documents. No re...

CVE-2000-1021

Heap overflow in WebConfig in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL...

CVE-2000-1020

Heap overflow in Worldclient in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL...

CVE-2000-1020

CVE-2000-1020 describes a heap overflow in Worldclient of MDaemon (versions 3.1.1 and earlier) that can be triggered by a long URL, allowing remote attackers to cause a denial of service and potentially execute arbitrary commands. The issue is exploitable over the network without authentication, ...

CVE-2000-0716

WorldClient email client in MDaemon 2.8 includes the session ID in the referer field of an HTTP request when the user clicks on a URL, which allows the visited web site to hijack the session ID and read the user's email...

CVE-2000-0501

MDaemon 2.8.5.0 POP server is affected by a race condition that can cause a denial of service when a UIDL command is issued and the server is exited rapidly. The issue is described as a local DoS with partial availability impact and a low CVSS. No exploitation details are provided in the availabl...

CVE-2000-0501

Race condition in MDaemon 2.8.5.0 POP server allows local users to cause a denial of service by entering a UIDL command and quickly exiting the server...

VIGILANTE-2000012.txt

Mdaemon Web Services Heap Overflow DoS Advisory Code: VIGILANTE-2000012 Release Date: September 18, 2000 Systems Affected: - Mdaemon 3.1.1 for Windows NT It is likely that older versions are also affected. THE PROBLEM We want to start off by pointing out that this is not the same problem as was...

Уязвимость в MDaemon

В сеансе генерируется сеансовый ключ, который в любое время модет быть использован для доступа к почтовому ящику с любой машины...

Session hijacking in Alt-N's MDaemon 2.8

Hi, Here's a bugreport and a fix for MDaemon 2.8. Problem: It is possible to hijack an HTTP session from MDaemon / WorldClient Standard version 2.8 Description: MDaemon 2.8 comes with WorldClient Standard which allows you to read your mail using a browser. When you receive an HTML formatted page...

CVE-2000-0399

The CVE-2000-0399 entry concerns the MDaemon POP3 server. A buffer overflow in the POP server allows remote attackers to crash the service by sending a too-long user name, resulting in a denial of service. Affected component: MDaemon POP3 server (remote input to user field). Impact: remote DoS wi...

CVE-2000-0399

Buffer overflow in MDaemon POP server allows remote attackers to cause a denial of service via a long user name...

CVE-2000-0501

Race condition in MDaemon 2.8.5.0 POP server allows local users to cause a denial of service by entering a UIDL command and quickly exiting the server...

Alt-N MDaemon 2.8.5 - UIDL Denial of Service

Alt-N MDaemon 2.8.5 - UIDL Denial of Service source: https://www.securityfocus.com/bid/1366/info A remote user is capable of crashing Alt-N MDaemon 2.8.5.0 by executing the pass command, then the UIDL command and quitting the mail server before the UIDL has returned a response. This must be done...