CVE-2006-5968

MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions (Users create files/directories), which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemon\APP folder, which is an untrusted search path element due to insecure permissions.

🔗 References (14)

• PSIRT-CNA@flexerasoftwarehttp://secunia.com/advisories/21554
• PSIRT-CNA@flexerasoftwarehttp://secunia.com/secunia_research/2006-67/advisory/
• PSIRT-CNA@flexerasoftwarehttp://securityreason.com/securityalert/1890
• PSIRT-CNA@flexerasoftwarehttp://securitytracker.com/id?1017238
• PSIRT-CNA@flexerasoftwarehttp://www.securityfocus.com/archive/1/451821/100/100/threaded
• PSIRT-CNA@flexerasoftwarehttp://www.vupen.com/english/advisories/2006/4538
• PSIRT-CNA@flexerasoftwarehttps://exchange.xforce.ibmcloud.com/vulnerabilities/30331
• af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/21554
• af854a3a-2127-422b-91ae-364da2661108http://secunia.com/secunia_research/2006-67/advisory/
• af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/1890
• af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1017238
• af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/451821/100/100/threaded
• af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/4538
• af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/30331