Secunia

Inferno has discovered a vulnerability in LogMeIn, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. change proxy settings or schedule a restart.

Note: In combination with other problems, this can further be exploited to disclose sensitive information (e.g. local files) and conduct script insertion attacks. According to the vendor, remote logins (e.g. logins to a computer via logmein.com, a desktop shortcut, or a LogMeIn RSS feed) are not affected.

The vulnerability is confirmed in LogMeIn Pro version 4.0.784. Other versions may also be affected.

Solution
The vendor states that a fix is scheduled for the next release in July.
Further details available in Customer Area

Provided and/or discovered by
Inferno

Changelog
Further details available in Customer Area

Original Advisory
Inferno:
http://securethoughts.com/2009/06/multiple-vulnerabilities-in-logmein-web-interface-can-be-used-to-control-your-computer-and-steal-arbitary-files/

Deep Links
Links available in Customer Area