MDaemon folder privilege escalation

mdaemon-folder-privilege-escalation (30331) The risk level is classified as HighHigh Risk

Description:

MDaemon could allow a local attacker to gain elevated privileges, caused by insecure permissions on the MDaemon folder. A local attacker with user privileges could create a specially-crafted RASAPI32.DLL or MPRAPI.DLL library file in the MDaemon\APP directory, which could be used to execute code with SYSTEM privileges.

Platforms Affected:

  • Alt-N, Mdaemon 9.0.5
  • Alt-N, Mdaemon 9.0.6
  • Alt-N, Mdaemon 9.51
  • Alt-N, Mdaemon 9.53

Remedy:

No remedy available as of November 29, 2008.

Consequences:

Gain Privileges

References:

  • MDaemon Web page, Secure Email Server Software - Antispam & Antivirus Mail Server - MDaemon by Alt-N Technologies at http://www.altn.com/.
  • BID-21127: Alt-N MDaemon Local Insecure Default Directory Permisions Vulnerability
  • CVE-2006-5968: MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions (Users create files/directories), which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemon\APP folder, which is an untrusted search path element due to insecure permissions.
  • SA21554: MDaemon Insecure Default Directory Permissions
  • SECTRACK ID: 1017238: MDaemon Insecure Directory Permissions Let Local Users Gain Elevated Privileges
  • VUPEN/ADV-2006-4538: MDaemon Insecure Default File Permissions Privilege Escalation Vulnerability

Reported:

Nov 16, 2006

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.

For corrections or additions please email xforce@iss.net

Return to the main page