CVE-2006-5968

MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions (Users create files/directories), which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemon\APP folder, which is an untrusted search path element due to insecure permissions.

CVSS v2.0 4.6 MEDIUM

4.6^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/secunia_research/2006-67/advisory/	Vendor Advisory
http://securitytracker.com/id?1017238
http://secunia.com/advisories/21554
http://securityreason.com/securityalert/1890
http://www.vupen.com/english/advisories/2006/4538
https://exchange.xforce.ibmcloud.com/vulnerabilities/30331
http://www.securityfocus.com/archive/1/451821/100/100/threaded

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:alt-n:mdaemon:9.53:::::::*
	cpe:2.3:a:alt-n:mdaemon:9.0.6:::::::*
	cpe:2.3:a:alt-n:mdaemon:9.51:::::::*
	cpe:2.3:a:alt-n:mdaemon:9.0.5:::::::*

Information

Published : 2006-11-17 14:07

Updated : 2018-10-17 14:46

NVD link : CVE-2006-5968

Mitre link : CVE-2006-5968

JSON object : View

CWE

NVD-CWE-Other

Products Affected

alt-n

mdaemon

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/secunia_research/2006-67/advisory/", "name": "http://secunia.com/secunia_research/2006-67/advisory/", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://securitytracker.com/id?1017238", "name": "1017238", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/21554", "name": "21554", "tags": [], "refsource": "SECUNIA"}, {"url": "http://securityreason.com/securityalert/1890", "name": "1890", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2006/4538", "name": "ADV-2006-4538", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30331", "name": "mdaemon-folder-privilege-escalation(30331)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/451821/100/100/threaded", "name": "20061116 Secunia Research: MDaemon Insecure Default Directory Permissions", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions (Users create files/directories), which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemon\\APP folder, which is an untrusted search path element due to insecure permissions."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-5968", "ASSIGNER": "PSIRT-CNA@flexerasoftware.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-11-17T22:07Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:alt-n:mdaemon:9.53:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:alt-n:mdaemon:9.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:alt-n:mdaemon:9.51:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:alt-n:mdaemon:9.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-17T21:46Z"}

4.6 /10