PT-2006-5406 · Alt N · Alt-N Webadmin+1

Ttg · Published 2006-09-07 · Updated 2018-10-17 · CVE-2006-4620

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Alt-N WebAdmin versions 3.2.5 and possibly earlier versions MDaemon versions 9.0.6 and possibly earlier versions

Description The issue allows remote authenticated domain administrators to gain privileges and obtain access to the system mail queue. This is achieved by modifying the mailbox of the MDaemon user account to use the mailbox of another account through the useredit account.wdm module in Alt-N WebAdmin.

Recommendations For Alt-N WebAdmin version 3.2.5, restrict access to the useredit account.wdm module to prevent unauthorized modifications to the MDaemon user account mailbox. For MDaemon version 9.0.6, limit privileges for domain administrators to prevent them from accessing the system mail queue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-4620

Affected Products

Alt-N Webadmin

Mdaemon

References · 8

• http://secunia.com/advisories/21727 · Vendor Advisory
• http://teklow.com/advisories/TTG0602.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4620 · Security Note
• http://files.altn.com/WebAdmin/Release/RelNotes_en.txt · Patch
• http://securityreason.com/securityalert/1516 · Note
• http://securityfocus.com/archive/1/445153/100/0/threaded · Note
• http://osvdb.org/28548 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28776 · Note