[Full-disclosure] ALT-N MDaemon multiple vulnerabilities

Hello this is kcope, there are two remote vulnerabilities in the latest ALT-N MDaemon imapd product i don't know if any of them is exploitable .. the stack based buffer overflow seems promising, but it's not preauth so i didn't investigate it further. 1. Remote denial of service in AUTHENTICATE...

Alt-N MDaemon 8.0 - IMAP Server CREATE Remote Buffer Overflow (PoC)

source: https://www.securityfocus.com/bid/14315/info Alt-N MDaemon IMAP Server is affected by a remote buffer overflow vulnerability. This issue presents itself when an attacker submits excessive data through the CREATE command subsequent to authentication This vulnerability may be leveraged to...

CVE-2002-1738

CVE-2002-1738 affects Alt-N Technologies MDaemon 5.0.5.0 and earlier. The issue is that a default MDaemon mail account is created with the password “MServer,” which could allow remote attackers to send anonymous email. The available sources describe the affected product and the default credential...

CVE-2002-1739

Alt-N Technologies Mdaemon versions 5.0–5.0.6 store user passwords with a weak encryption algorithm, enabling local users to crack them. Local access is required; confidentiality impact is indicated. Remediation: upgrade to a version that uses stronger password encryption. The connected PT-securi...

CVE-2002-1740

The CVE-2002-1740 entry describes a buffer overflow in WorldClient.cgi (WorldClient) of Alt-N Technologies MDaemon

CVE-2002-1741

CVE-2002-1741 describes a directory traversal vulnerability in WorldClient.cgi within WorldClient for Alt-N Technologies MDaemon

CVE-2002-1738

Alt-N Technologies MDaemon 5.0.5.0 and earlier creates a default MDaemon mail account with a password of MServer, which could allow remote attackers to send anonymous email...

CVE-2002-1739

Alt-N Technologies Mdaemon 5.0 through 5.0.6 uses a weak encryption algorithm to store user passwords, which allows local users to crack passwords...

CVE-2002-1740

Buffer overflow in WorldClient.cgi in WorldClient in Alt-N Technologies MDaemon 5.0.5.0 and earlier allows local users to execute arbitrary code via a long folder name NewFolder parameter...

CVE-2002-1738: Undefined Security Weakness

Alt-N Technologies MDaemon 5.0.5.0 and earlier creates a default MDaemon mail account with a password of MServer, which could allow remote attackers to send anonymous email...

[SA15544] Fast n Furious DtDNS Updater Command Line Argument Disclosure

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

CVE-2003-1200

Stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a long From parameter to Form2Raw.cgi...

CVE-2003-1200

CVE-2003-1200 is a stack-based buffer overflow in Alt-N MDaemon’s WorldClient form2raw.cgi (FORM2RAW.exe). A long From parameter to Form2Raw.cgi can cause remote code execution. Affected products include MDaemon versions 6.5.2–6.8.5 with WorldClient HTTP server enabled; upgrade to 6.8.6 or remove...

CVE-2003-1200: Undefined Security Weakness

Stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a long From parameter to Form2Raw.cgi...

CVE-2005-1228: Undefined Security Weakness

Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. dot dot in the original filename within a compressed file...

CVE-2005-0318

CVE-2005-0318 concerns Alt-N WebAdmin 3.0.4, where useredit_account.wdm fails to properly validate edits by the logged-in user. The root cause is insufficient validation of the account-edit parameter, enabling remote authenticated users to modify other users’ account information via a tampered us...

CVE-2005-0319

The CVE-2005-0319 entry describes a Direct remote injection vulnerability in the Alt-N WebAdmin 3.0.4 component modalfram.wdm, where an attacker can load external webpages and inject arbitrary HTML or script to facilitate cross-site scripting (XSS) and phishing. The root cause is an input/content...

CVE-2005-0317

Cross-site scripting XSS vulnerability in usereditaccount.wdm in Alt-N WebAdmin 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the user parameter...

CVE-2005-0319

Direct remote injection vulnerability in modalfram.wdm in Alt-N WebAdmin 3.0.4 allows remote attackers to load external webpages that appear to come from the WebAdmin server, which allows remote attackers to inject arbitrary HTML or web script to facilitate cross-site scripting XSS and phishing...

CVE-2005-0317

CVE-2005-0317 affects Alt-N WebAdmin 3.0.4. The XSS flaw is in useredit_account.wdm (via the user parameter) and is caused by insufficient input validation/filtering. The NVD entry lists a CVSS v2 base score of 4.3 (Medium) with network attack vector, no confidentiality impact, partial integrity ...