Alt-N MDaemon WorldClient Authentication Credentials Information Disclosure Vulnerability

Bugtraq ID:	58074
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 21 2013 12:00AM
Updated:	Mar 19 2015 09:31AM
Credit:	QSecure and Demetris Papapetrou
Vulnerable:
Not Vulnerable:

Alt-N MDaemon WorldClient Authentication Credentials Information Disclosure Vulnerability

Alt-N MDaemon's WorldClient is prone to a remote information-disclosure vulnerability that may disclose authentication credentials.

An attacker can exploit this vulnerability to obtain sensitive information; this may aid in further attacks.

Alt-N MDaemon versions 13.0.3 and 12.5.6 are vulnerable; other versions may also be affected.

Alt-N MDaemon WorldClient Authentication Credentials Information Disclosure Vulnerability

Attackers can exploit this issue through a browser.

The following example URI is available:

http://www.example.com/WorldClient.dll?Session=[SESSION_ID]&View=WebAdmin

Alt-N MDaemon WorldClient Authentication Credentials Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Alt-N MDaemon WorldClient Authentication Credentials Information Disclosure Vulnerability

References:

• Alt-N Homepage (Alt-N)
  
• Alt-N MDaemon's WorldClient Disclosure of Authentication Credentials Vulnerabili (QSecure)
  
• MDaemon Release Notes (Alt-N)