CVE-1999-0844: Medium severity Deerfield Mdaemon vulnerability
Denial of service in MDaemon WorldClient and WebConfig services via a long URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the WorldClient service if it is not required to remove exposure to long-URL denial-of-service vectors.
MDaemon WorldClient service_enabled = false (if not required) - Configuration
Disable the WebConfig service if it is not required to remove exposure to long-URL denial-of-service vectors.
MDaemon WebConfig service_enabled = false (if not required) - Configuration
Configure MDaemon or the front-end web server/WAF to enforce a maximum URL length and perform request validation to reject excessively long URLs that can trigger denial-of-service.
MDaemon / front-end HTTP handling max_url_length / request validation = set a reasonable maximum URL length and reject overly long URLs - Compensating control
Restrict access to WorldClient and WebConfig services to trusted IPs or internal networks at the firewall or perimeter; place services behind a WAF or reverse proxy that drops requests with excessively long URLs.
- Operational
Monitor HTTP access logs for repeated or large/long-URL requests, block offending IP addresses or networks, and apply rate-limiting on connections to WorldClient/WebConfig until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0844?
CVE-1999-0844 is classified as a denial of service vulnerability.
How do I fix CVE-1999-0844?
To fix CVE-1999-0844, update the MDaemon software to the latest version which contains the necessary patches.
What software versions are affected by CVE-1999-0844?
CVE-1999-0844 affects MDaemon versions 2.8.5 and 2.8.6.
What does CVE-1999-0844 exploit?
CVE-1999-0844 exploits the web services of MDaemon, specifically the WorldClient and WebConfig services through long URLs.
Can CVE-1999-0844 be exploited remotely?
Yes, CVE-1999-0844 can be exploited remotely by sending specially crafted requests to the affected services.