CVE-2006-2447
published 2006-06-06CVE-2006-2447: SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message…
PriorityP261medium5.1CVSS 2.0
AVNACHAuNCPIPAP
EXPLOIT
EPSS
74.70%
99.4th percentile
SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | spamassassin | — | — |
| apache | spamassassin | — | — |
| apache | spamassassin | — | — |
| apache | spamassassin | >= 0 < 3.1.3-1 | 3.1.3-1 |
| apache | spamassassin | >= 0 < 3.1.3-1 | 3.1.3-1 |
| apache | spamassassin | >= 0 < 3.1.3-1 | 3.1.3-1 |
| apache | spamassassin | >= 0 < 3.1.3-1 | 3.1.3-1 |
| debian | spamassassin | < spamassassin 3.1.3-1 (bookworm) | spamassassin 3.1.3-1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring spamd (port 783) traffic for a 'User:' header beginning with a semicolon (';'), which is the command-injection delimiter used in the exploit. ↗
- →Alert on SPAMC protocol 'PROCESS SPAMC/1.2' requests on TCP/783 that contain a 'User:' header value starting with ';' — this is the exact attack pattern for CVE-2006-2447. ↗
- →Vulnerable condition requires spamd to be launched with both '-v'/'--vpopmail' AND '-P'/'--paranoid' switches simultaneously; audit process command lines for this combination. ↗
- →SpamAssassin spamd versions prior to 3.1.3 are vulnerable; identify and flag any running instances of spamd older than 3.1.3 in asset inventory. ↗
- ·The vulnerability is only exploitable when spamd is started with BOTH the vpopmail (-v/--vpopmail) AND paranoid (-P/--paranoid) switches; these are non-default options, significantly limiting exposure. ↗
- ·Red Hat noted that no IMAP servers shipped with RHEL support vpopmail, further reducing the attack surface in standard RHEL deployments. ↗
CVSS provenance
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
osv5.1MEDIUM
vendor_debian5.1MEDIUM
vendor_redhat5.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
security flaw
vendor_redhat·2006-06-06·CVSS 5.1
CVE-2006-2447 [MEDIUM] security flaw
security flaw
SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.
Debian
CVE-2006-2447: spamassassin - SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) swit...
vendor_debian·2006·CVSS 5.1
CVE-2006-2447 [MEDIUM] CVE-2006-2447: spamassassin - SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) swit...
SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.
Scope: local
bookworm: resolved (fixed in 3.1.3-1)
bullseye: resolved (fixed in 3.1.3-1)
forky: resolved (fixed in 3.1.3-1)
sid: resolved (fixed in 3.1.3-1)
trixie: resolved (fixed in 3.1.3-1)
GHSA
GHSA-xj48-9vrg-vxxc: SpamAssassin before 3
ghsa_unreviewed·2022-05-01
CVE-2006-2447 [MEDIUM] GHSA-xj48-9vrg-vxxc: SpamAssassin before 3
SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.
OSV
CVE-2006-2447: SpamAssassin before 3
osv·2006-06-06·CVSS 5.1
CVE-2006-2447 [MEDIUM] CVE-2006-2447: SpamAssassin before 3
SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.
No detection rules found.
Exploit-DB
SpamAssassin spamd - Remote Command Execution (Metasploit)
exploitdb·2010-04-30
CVE-2006-2447 SpamAssassin spamd - Remote Command Execution (Metasploit)
SpamAssassin spamd - Remote Command Execution (Metasploit)
---
##
# $Id: spamassassin_exec.rb 9179 2010-04-30 08:40:19Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'SpamAssassin spamd Remote Command Execution',
'Description' => %q{
This module exploits a flaw in the SpamAssassin spamd service by specifying
a malicious vpopmail User header, when running with vpopmail and paranoid
modes enabled (non-default). Versions prior to v3.1.3 are vulnerable
},
'Author' => [ 'patrick' ],
'License' => MSF_LICENSE,
'Version' => '$Revision: 917
Exploit-DB
SpamAssassin spamd 3.1.3 - Command Injection (Metasploit)
exploitdb·2006-06-06
CVE-2006-2447 SpamAssassin spamd 3.1.3 - Command Injection (Metasploit)
SpamAssassin spamd 3.1.3 - Command Injection (Metasploit)
---
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'SpamAssassin spamd Remote Command Execution',
'Description' => %q{
This module exploits a flaw in the SpamAssassin spamd service by specifying
a malicious vpopmail User header, when running with vpopmail and paranoid
modes enabled (non-default). Versions prior to v3.1.3 are vulnerable
},
'Author' => [ 'patrick' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2006-2447' ],
[ 'OSVDB', '26
Metasploit
SpamAssassin spamd Remote Command Execution
metasploit
SpamAssassin spamd Remote Command Execution
SpamAssassin spamd Remote Command Execution
This module exploits a flaw in the SpamAssassin spamd service by specifying a malicious vpopmail User header, when running with vpopmail and paranoid modes enabled (non-default). Versions prior to v3.1.3 are vulnerable
Bugzilla
CVE-2006-2447 security flaw
bugzilla·2018-08-16·CVSS 5.1
CVE-2006-2447 [MEDIUM] CVE-2006-2447 security flaw
CVE-2006-2447 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.
Bugzilla
CVE-2006-2447 spamassassin arbitrary command execution
bugzilla·2006-06-06·CVSS 5.1
CVE-2006-2447 [MEDIUM] CVE-2006-2447 spamassassin arbitrary command execution
CVE-2006-2447 spamassassin arbitrary command execution
+++ This bug was initially created as a clone of Bug #193865 +++
CVE-2006-2447 spamassassin arbitrary command execution
If spamd is run with the
"-v" / "--vpopmail" switch, AND with the "-P" / "--paranoid" switch
It becomes possible to execute arbitrary commands as the user spamd is
running as.
This issue is mitigated by the fact that no imap servers as shipped
with RHEL support vpopmail. These options are also not the default
spamd options when it is started as a service.
This issue should also affect FC4
Discussion:
Pushed updates to FC4 and FC5.
Bugzilla
CVE-2006-2447 spamassassin arbitrary command execution
bugzilla·2006-06-02·CVSS 5.1
CVE-2006-2447 [MEDIUM] CVE-2006-2447 spamassassin arbitrary command execution
CVE-2006-2447 spamassassin arbitrary command execution
CVE-2006-2447 spamassassin arbitrary command execution
If spamd is run with the
"-v" / "--vpopmail" switch, AND with the "-P" / "--paranoid" switch
It becomes possible to execute arbitrary commands as the user spamd is
running as.
This issue is mitigated by the fact that no imap servers as shipped
with RHEL support vpopmail. These options are also not the default
spamd options when it is started as a service.
Discussion:
Lifting embargo.
---
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
http://secunia.com/advisories/20430http://secunia.com/advisories/20443http://secunia.com/advisories/20482http://secunia.com/advisories/20531http://secunia.com/advisories/20566http://secunia.com/advisories/20692http://securitytracker.com/id?1016230http://securitytracker.com/id?1016235http://www.debian.org/security/2006/dsa-1090http://www.gentoo.org/security/en/glsa/glsa-200606-09.xmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:103http://www.nabble.com/ANNOUNCE%3A-Apache-SpamAssassin-3.1.3-available%21-t1736096.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0543.htmlhttp://www.securityfocus.com/archive/1/436288/100/0/threadedhttp://www.securityfocus.com/bid/18290http://www.trustix.org/errata/2006/0034/http://www.vupen.com/english/advisories/2006/2148https://exchange.xforce.ibmcloud.com/vulnerabilities/27008https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9184http://secunia.com/advisories/20430http://secunia.com/advisories/20443http://secunia.com/advisories/20482http://secunia.com/advisories/20531http://secunia.com/advisories/20566http://secunia.com/advisories/20692http://securitytracker.com/id?1016230http://securitytracker.com/id?1016235http://www.debian.org/security/2006/dsa-1090http://www.gentoo.org/security/en/glsa/glsa-200606-09.xmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:103http://www.nabble.com/ANNOUNCE%3A-Apache-SpamAssassin-3.1.3-available%21-t1736096.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0543.htmlhttp://www.securityfocus.com/archive/1/436288/100/0/threadedhttp://www.securityfocus.com/bid/18290http://www.trustix.org/errata/2006/0034/http://www.vupen.com/english/advisories/2006/2148https://exchange.xforce.ibmcloud.com/vulnerabilities/27008https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9184
2006-06-06
Published