PT-2006-6631 · Alt N Technologies · Mdaemon

Publicado 2006-11-17 · Atualizado 2018-10-17 · CVE-2006-5968

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MDaemon versions 9.0.5 through 9.0.6, 9.51, and 9.53

Description The issue allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemonAPP folder. This is due to the MDaemon application folder being installed with insecure permissions, allowing users to create files and directories.

Recommendations For versions 9.0.5 through 9.0.6, 9.51, and 9.53, consider restricting write access to the MDaemonAPP folder to prevent local users from creating malicious libraries. As a temporary workaround, monitor the MDaemonAPP folder for any suspicious RASAPI32.DLL or MPRAPI.DLL files.

Correção

Identificadores relacionados

CVE-2006-5968

Produtos afetados

Mdaemon

Referências · 10

• http://secunia.com/advisories/21554 · Nota
• http://securitytracker.com/id?1017238 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5968 · Nota de Segurança
• http://xforce.iss.net/xforce/xfdb/30331 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5968 · Nota
• http://vupen.com/english/advisories/2006/4538 · Nota
• http://secunia.com/secunia_research/2006-67/advisory · Aviso do Fabricante
• http://securityfocus.com/archive/1/451821/100/100/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30331 · Nota
• http://securityreason.com/securityalert/1890 · Nota