Alt-N MDaemon WorldClient User Enumeration Weakness

Bugtraq ID:	58075
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 21 2013 12:00AM
Updated:	Feb 21 2013 12:00AM
Credit:	QSecure and Demetris Papapetrou
Vulnerable:
Not Vulnerable:

Alt-N MDaemon WorldClient User Enumeration Weakness

Alt-N MDaemon's WorldClient is prone to a user-enumeration weakness.

An attacker may leverage this issue to harvest valid usernames, which may aid in brute-force attacks.

Alt-N MDaemon versions 13.0.3 and 12.5.6 are vulnerable; other versions may also be affected.

Alt-N MDaemon WorldClient User Enumeration Weakness

An attacker can exploit this issue by supplying the application with crafted requests.

The following request is available:

http://www.example.com/WorldClient.dll?View=fbinfo&User=[Username]

Alt-N MDaemon WorldClient User Enumeration Weakness

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Alt-N MDaemon WorldClient User Enumeration Weakness

References:

• Alt-N Homepage (Alt-N)
  
• Alt-N MDaemon's WorldClient Username Enumeration Vulnerability (QSecure)
  
• MDaemon Release Notes (Alt-N)