Secunia

Protego has reported flere vulnerabilities in MondoSearch, which can be exploited by malicious people to use the application as a proxy, cause a DoS (Denial of Service), or disclose certain administrative usernames.

1) An insecurity in "MsmHigh.exe" can be exploited to use a vulnerable web server as a proxy for web requests by passing a specially crafted query string.

2) It is possible to gain knowledge of the usernames of users, who have access to the administration site, by accessing the "MsmChgPw.msk" file with certain parameters.

3) The processes "MsmHigh.exe" and "MsmLink.exe" load a new instance of themselves each time a request is received. This can be exploited to consume all available memory by making multiple requests.

The vulnerabilities have been reported in versions prior to 5.1b.

Solution
Update to version 5.1b.
Further details available in Customer Area

Provided and/or discovered by
1+2) Uffe Nielsen, Protego.
3) Dennis Rand, Protego.

Changelog
Further details available in Customer Area

Original Advisory
Mondosoft:
http://www.mondosoft.com/security/

PROTEGO:
http://www.protego.dk/advisories/200401.html
http://www.protego.dk/advisories/200402.html
http://www.protego.dk/advisories/200403.html
http://www.protego.dk/advisories/200404.html

Deep Links
Links available in Customer Area