CVE-2005-4266

WorldClient.dll in Alt-N MDaemon and WorldClient 8.1.3 trusts a Session parameter that contains a randomly generated session ID that is associated with a username, which allows remote attackers to perform actions as other users by guessing or sniffing the random value.

Score

CVSS 2.0 7.5 High

Status

Modified - cve@mitre.org

Published

2005-12-15

Last modified

2024-09-16

Affected products

• Mdaemon (Alt-n)
• Worldclient (Alt-n)

References

• http://secunia.com/advisories/17990
• http://www.ipomonis.com/advisories/mdaemon.zip