CVE-2006-5968

MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions (Users create files/directories), which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemon\APP folder, which is an untrusted search path element due to insecure permissions.

CVSS v2.0 4.6 MEDIUM

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/21554
http://secunia.com/secunia_research/2006-67/advisory/	Vendor Advisory
http://securityreason.com/securityalert/1890
http://securitytracker.com/id?1017238
http://www.securityfocus.com/archive/1/451821/100/100/threaded
http://www.vupen.com/english/advisories/2006/4538
https://exchange.xforce.ibmcloud.com/vulnerabilities/30331

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:alt-n:mdaemon:9.0.5:::::::*
	cpe:2.3:a:alt-n:mdaemon:9.0.6:::::::*
	cpe:2.3:a:alt-n:mdaemon:9.51:::::::*
	cpe:2.3:a:alt-n:mdaemon:9.53:::::::*

History

No history.

Information

Published : 2006-11-17 22:07

Updated : 2018-10-17 21:46

NVD link : CVE-2006-5968

Mitre link : CVE-2006-5968

CVE.ORG link : CVE-2006-5968

JSON object : View

Products Affected

alt-n

mdaemon

CWE

NVD-CWE-Other

{"id": "CVE-2006-5968", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-11-17T22:07:00.000", "references": [{"url": "http://secunia.com/advisories/21554", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://secunia.com/secunia_research/2006-67/advisory/", "tags": ["Vendor Advisory"], "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://securityreason.com/securityalert/1890", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://securitytracker.com/id?1017238", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://www.securityfocus.com/archive/1/451821/100/100/threaded", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://www.vupen.com/english/advisories/2006/4538", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30331", "source": "PSIRT-CNA@flexerasoftware.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions (Users create files/directories), which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemon\\APP folder, which is an untrusted search path element due to insecure permissions."}, {"lang": "es", "value": "MDaemon 9.0.5, 9.0.6, 9.51, y 9.53, y posiblemente otras versiones, instalan la carpeta de la aplicaci\u00f3n MDaemon con permisos no seguros (los usuarios crean ficheros/directorios), lo cual permite a un usuario local ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de la creacion de c\u00f3digo malicioso de las librerias RASAPI32.DLL o MPRAPI.DLL en la carpeta MDaemon\\APP, lo cual no es una carpeta de b\u00fasqueda correcta debido a lo permisos poco seguros."}], "lastModified": "2018-10-17T21:46:09.437", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:alt-n:mdaemon:9.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20CB70E2-1E3A-4FC1-BD26-E22EAC68D874"}, {"criteria": "cpe:2.3:a:alt-n:mdaemon:9.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC8AC4F7-CADE-448D-82C6-C4D19EAAADFB"}, {"criteria": "cpe:2.3:a:alt-n:mdaemon:9.51:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A3610BC-6E11-437F-B7DF-3FEC2812BBC3"}, {"criteria": "cpe:2.3:a:alt-n:mdaemon:9.53:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B578384C-73DA-4D2A-8A5D-5293391A3172"}], "operator": "OR"}]}], "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com"}