Summaryinfo

A vulnerability, which was classified as critical, was found in Alt-N MDaemon up to 6.85. Affected by this issue is some unknown functionality of the file Form2Raw.exe. Executing a manipulation can lead to memory corruption. The attack can be launched remotely. Moreover, an exploit is present. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Alt-N MDaemon up to 6.85 (Mail Server Software) and classified as critical. This vulnerability affects some unknown functionality of the file Form2Raw.exe. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was disclosed 03/13/2004 by Angelo Rosiello with hat-squad security (Website). The advisory is available at rosiello.org. The attack can be initiated remotely. Technical details and also a exploit are known.

An exploit has been developed in C. It is possible to download the exploit at rosiello.org. It is declared as proof-of-concept. As 0-day the estimated underground price was around $5k-$25k.

Upgrading eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at altn.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Mail Server Software

Vendor

• Alt-N

Name

• MDaemon

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11
• 6.12
• 6.13
• 6.14
• 6.15
• 6.16
• 6.17
• 6.18
• 6.19
• 6.20
• 6.21
• 6.22
• 6.23
• 6.24
• 6.25
• 6.26
• 6.27
• 6.28
• 6.29
• 6.30
• 6.31
• 6.32
• 6.33
• 6.34
• 6.35
• 6.36
• 6.37
• 6.38
• 6.39
• 6.40
• 6.41
• 6.42
• 6.43
• 6.44
• 6.45
• 6.46
• 6.47
• 6.48
• 6.49
• 6.50
• 6.51
• 6.52
• 6.53
• 6.54
• 6.55
• 6.56
• 6.57
• 6.58
• 6.59
• 6.60
• 6.61
• 6.62
• 6.63
• 6.64
• 6.65
• 6.66
• 6.67
• 6.68
• 6.69
• 6.70
• 6.71
• 6.72
• 6.73
• 6.74
• 6.75
• 6.76
• 6.77
• 6.78
• 6.79
• 6.80
• 6.81
• 6.82
• 6.83
• 6.84
• 6.85

License

• free

Website

• Vendor: https://www.altn.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion