National Cyber-Alert System

Vulnerability Summary for CVE-2006-2447

Overview

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 18290

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/18290

External Source: REDHAT

Name: RHSA-2006:0543

Type: Advisory; Patch Information

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0543.html

External Source: CONFIRM

Name: http://www.nabble.com/ANNOUNCE%3A-Apache-SpamAssassin-3.1.3-available%21-t1736096.html

Type: Patch Information

Hyperlink:http://www.nabble.com/ANNOUNCE%3A-Apache-SpamAssassin-3.1.3-available%21-t1736096.html

External Source: VUPEN

Name: ADV-2006-2148

Type: Advisory; Patch Information

Hyperlink:http://www.frsirt.com/english/advisories/2006/2148

External Source: DEBIAN

Name: DSA-1090

Type: Advisory; Patch Information

Hyperlink:http://www.debian.org/security/2006/dsa-1090

External Source: SECUNIA

Name: 20443

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/20443

External Source: SECUNIA

Name: 20430

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/20430

External Source: XF

Name: spamassassin-spamd-command-execution(27008)

Hyperlink:http://xforce.iss.net/xforce/xfdb/27008

External Source: TRUSTIX

Name: 2006-0034

Hyperlink:http://www.trustix.org/errata/2006/0034/

External Source: BUGTRAQ

Name: 20060607 rPSA-2006-0096-1 spamassassin

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/436288/100/0/threaded

External Source: MANDRIVA

Name: MDKSA-2006:103

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:103

External Source: GENTOO

Name: GLSA-200606-09

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200606-09.xml

External Source: SECTRACK

Name: 1016235

Hyperlink:http://securitytracker.com/id?1016235

External Source: SECTRACK

Name: 1016230

Hyperlink:http://securitytracker.com/id?1016230

External Source: SECUNIA

Name: 20692

Hyperlink:http://secunia.com/advisories/20692

External Source: SECUNIA

Name: 20566

Hyperlink:http://secunia.com/advisories/20566

External Source: SECUNIA

Name: 20531

Hyperlink:http://secunia.com/advisories/20531

External Source: SECUNIA

Name: 20482

Hyperlink:http://secunia.com/advisories/20482

External Source: MANDRIVA

Name: MDKSA-2006:103

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:103