Access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.

Attackers with network access to the Apache web server can download and therefore read mGuard configuration profiles ('ATV profiles'). Such configuration profiles may contain sensitive information, e.g. private keys associated with IPsec VPN connections.

Stop the ApacheMDM Windows service.

Edit file /apache/conf/extra/httpd-mdm.conf and remove the instances of these lines for 'DocumentRoot' and alias '/atv':

Controls who can get stuff from this server.

Require all granted

refers to the directory in which FL MGUARD DM is installed.

Start the ApacheMDM Windows service.

This vulnerability is fixed in FL MGUARD DM 1.13.0.1. We advise all affected FL MGUARD DM 1.12.0 and 1.13.0 users to upgrade to FL MGUARD DM 1.13.0.1 or a later version.
Additional recommendations:

• Limit network access to the Apache web server to as few network addresses as possible.
• If possible, make use of encrypted mGuard configuration profiles.