PT-2006-5406 · Alt N · Alt-N Webadmin+1

Ttg · Publicado 2006-09-07 · Atualizado 2018-10-17 · CVE-2006-4620

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Alt-N WebAdmin versions 3.2.5 and possibly earlier versions MDaemon versions 9.0.6 and possibly earlier versions

Description The issue allows remote authenticated domain administrators to gain privileges and obtain access to the system mail queue. This is achieved by modifying the mailbox of the MDaemon user account to use the mailbox of another account through the useredit account.wdm module in Alt-N WebAdmin.

Recommendations For Alt-N WebAdmin version 3.2.5, restrict access to the useredit account.wdm module to prevent unauthorized modifications to the MDaemon user account mailbox. For MDaemon version 9.0.6, limit privileges for domain administrators to prevent them from accessing the system mail queue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-4620

Produtos afetados

Alt-N Webadmin

Mdaemon

Referências · 8

• http://secunia.com/advisories/21727 · Aviso do Fabricante
• http://teklow.com/advisories/TTG0602.txt · Aviso do Fabricante
• http://securityreason.com/securityalert/1516 · Nota
• http://securityfocus.com/archive/1/445153/100/0/threaded · Nota
• http://osvdb.org/28548 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4620 · Nota de Segurança
• http://files.altn.com/WebAdmin/Release/RelNotes_en.txt · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28776 · Nota