Published: 06/06/2006 Updated: 18/10/2018

CVSS v2 Base Score: 5.1 | Impact Score: 6.4 | Exploitability Score: 4.9

VMScore: 520

Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P

SpamAssassin prior to 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote malicious users to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache spamassassin 3.1.2
apache spamassassin 3.1.0
apache spamassassin 3.1.1

A vulnerability has been discovered in SpamAssassin, a Perl-based spam filter using text analysis, that can allow remote attackers to execute arbitrary commands This problem only affects systems where spamd is reachable via the internet and used with vpopmail virtual users, via the "-v" / "--vpopmail" switch, and with the "-P" / "--paranoid" switc ...

## # $Id: spamassassin_execrb 9179 2010-04-30 08:40:19Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' clas ...

## # $Id$ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote include Msf: ...

NVD-CWE-noinfo http://www.nabble.com/ANNOUNCE%3A-Apache-SpamAssassin-3.1.3-available%21-t1736096.html http://www.debian.org/security/2006/dsa-1090 http://www.redhat.com/support/errata/RHSA-2006-0543.html http://www.securityfocus.com/bid/18290 http://secunia.com/advisories/20443 http://secunia.com/advisories/20430 http://secunia.com/advisories/20482 http://www.gentoo.org/security/en/glsa/glsa-200606-09.xml http://www.trustix.org/errata/2006/0034/http://securitytracker.com/id?1016230 http://securitytracker.com/id?1016235 http://secunia.com/advisories/20531 http://secunia.com/advisories/20566 http://secunia.com/advisories/20692 http://www.mandriva.com/security/advisories?name=MDKSA-2006:103 http://www.vupen.com/english/advisories/2006/2148 https://exchange.xforce.ibmcloud.com/vulnerabilities/27008 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9184 http://www.securityfocus.com/archive/1/436288/100/0/threaded https://nvd.nist.gov https://www.debian.org/security/./dsa-1090 https://www.exploit-db.com/exploits/16920/

CVE-2006-2447

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect