CVE-2006-2447 Command injection in n/a
Remote attackers can execute arbitrary commands on SpamAssassin servers using vpopmail and the paranoid switch via crafted messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-2447?
CVE-2006-2447 is a medium-severity command injection vulnerability in n/a, published on 6 Jun 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.
Which versions are affected by CVE-2006-2447?
It affects 1 product.
Linux distribution packages (8)
spamassassin Red Hat:enterprise_linux:4::as | All versions | 0:3.0.6-1.el4 |
spamassassin-debuginfo Red Hat:enterprise_linux:4::as | All versions | 0:3.0.6-1.el4 |
spamassassin Red Hat:enterprise_linux:4::desktop | All versions | 0:3.0.6-1.el4 |
spamassassin-debuginfo Red Hat:enterprise_linux:4::desktop | All versions | 0:3.0.6-1.el4 |
spamassassin Red Hat:enterprise_linux:4::es | All versions | 0:3.0.6-1.el4 |
spamassassin-debuginfo Red Hat:enterprise_linux:4::es | All versions | 0:3.0.6-1.el4 |
spamassassin Red Hat:enterprise_linux:4::ws | All versions | 0:3.0.6-1.el4 |
spamassassin-debuginfo Red Hat:enterprise_linux:4::ws | All versions | 0:3.0.6-1.el4 |
Products include Apache Spamassassin.
How do I fix CVE-2006-2447?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2006-2447 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-2447 exists.
Public exploit code: 1 Metasploit module and 2 Exploit-DB entries.
Other vulnerabilities in n/a
- CVE-2020-1946 Apache SpamAssassin has an OS Command Injection vulnerability
- CVE-2018-11780 Code injection in Apache SpamAssassin
- CVE-2020-1930 Command injection in Apache SpamAssassin
- CVE-2020-1931 Command injection in Apache SpamAssassin
- CVE-2018-11781 Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.
Sources
Also known as DEBIAN-CVE-2006-2447, DSA-1090-1, GHSA-xj48-9vrg-vxxc, RHSA-2006:0543.