Secunia

Secunia Research has discovered a vulnerability in MDaemon, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an input validation error in MDaemon's content filter. This can be exploited to write files to arbitrary directories via e.g. a specially crafted email containing a virus-infected attachment with directory traversal sequences in its filename (e.g. "../../../../../file.exe").

Successful exploitation causes the file to be quarantined to an arbitrary directory (e.g. the startup folder), but requires the attachment quarantine feature is enabled.

The vulnerability has been confirmed in version 8.0.4. Prior versions may also be affected.

Solution
Update to version 8.1.0.

Provided and/or discovered by
Tan Chew Keong, Secunia Research.

Original Advisory
Alt-N Technologies:
http://files.altn.com/MDaemon/Release/RelNotes_en.txt

Deep Links
Links available in Customer Area