PT-2005-4897 · Alt N · Alt-N Mdaemon

Published 2005-12-13 · Updated 2017-07-20 · CVE-2005-4209

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Alt-N MDaemon version 8.1.3

Description The issue allows remote attackers to prevent arbitrary users from accessing their inboxes via script tags in the Subject header of an e-mail message. This is possibly due to a cross-site scripting (XSS) vulnerability, which occurs when an application includes user input in its output without proper validation, allowing an attacker to inject scripts into the application.

Recommendations For Alt-N MDaemon version 8.1.3, consider disabling the ability to include script tags in the Subject header of e-mail messages as a temporary workaround until a patch is available. Restrict access to the Inbox folder to minimize the risk of exploitation. Avoid using the Subject header in the affected webmail client until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2005-4209

Affected Products

Alt-N Mdaemon

References · 7

• 🔥 http://securityfocus.com/bid/15815 · Exploit
• 🔥 http://secunia.com/advisories/17990 · Exploit
• 🔥 https://exploit-db.com/exploits/26779 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4209 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23551 · Note
• http://ipomonis.com/advisories/mdaemon.zip · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4209 · Note