CVE-2006-6424
published 2006-12-27CVE-2006-6424: Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IMAP verbs…
PriorityP265critical9CVSS 2.0
AVNACLAuSCCICAC
EXPLOIT
EPSS
57.91%
99.0th percentile
Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IMAP verbs when specifying command continuation requests to IMAPD, resulting in a heap overflow; and (2) via crafted arguments to the STOR command to the Network Messaging Application Protocol (NMAP) daemon, resulting in a stack overflow.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| novell | netmail | <= 3.5.2 | — |
| novell | netmail | — | — |
| novell | netmail | — | — |
| novell | netmail | — | — |
| novell | netmail | — | — |
| novell | netmail | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect NMAP STOR command with an argument exceeding 253 bytes on TCP port 689, which is indicative of the buffer overflow exploit attempt against Novell NetMail NMAP daemon. ↗
- →Monitor for IMAP command continuation requests where literals are appended to IMAP verbs, as this triggers the heap overflow vector in IMAPD. ↗
- →The exploit sends a USER command with random text followed by STOR on port 689; alert on oversized STOR arguments (>253 bytes) in NMAP protocol traffic. ↗
- →The exploit checks for a '1000' response code after authentication to confirm trusted host status before sending the payload; this handshake pattern on port 689 can be used as a behavioral indicator. ↗
- ·The Metasploit module targets only Windows 2000 Pro SP4 English with a hardcoded return address; the exploit as written will not work against other OS versions or service packs without a different return address. ↗
- ·Payload space is constrained to 500 bytes with bad characters \x00, \x0a, \x0d, \x20 excluded; shellcode used in detection testing must respect these constraints. ↗
- ·The vulnerability affects Novell NetMail before version 3.52e FTF2; systems running 3.52e FTF2 or later are not affected. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Novell NetMail 3.52d - NMAP STOR Buffer Overflow (Metasploit)
exploitdb·2010-05-09
CVE-2006-6424 Novell NetMail 3.52d - NMAP STOR Buffer Overflow (Metasploit)
Novell NetMail 3.52d - NMAP STOR Buffer Overflow (Metasploit)
---
##
# $Id: nmap_stor.rb 9262 2010-05-09 17:45:00Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Novell NetMail %q{
This module exploits a stack buffer overflow in Novell's Netmail 3.52 NMAP STOR
verb. By sending an overly long string, an attacker can overwrite the
buffer and control program execution.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$Revision: 9262 $',
'References' =>
[
[ 'CVE', '2006-6424' ],
[ 'OSVDB', '31363' ],
[ 'BID', '21725' ],
Metasploit
Novell NetMail NMAP STOR Buffer Overflow
metasploit
Novell NetMail NMAP STOR Buffer Overflow
Novell NetMail NMAP STOR Buffer Overflow
This module exploits a stack buffer overflow in Novell's Netmail 3.52 NMAP STOR verb. By sending an overly long string, an attacker can overwrite the buffer and control program execution.
No writeups or analysis indexed.
http://secunia.com/advisories/23437http://securityreason.com/securityalert/2081http://securitytracker.com/id?1017437http://www.cirt.dk/advisories/cirt-48-advisory.txthttp://www.kb.cert.org/vuls/id/381161http://www.kb.cert.org/vuls/id/912505http://www.securityfocus.com/archive/1/455201/100/0/threadedhttp://www.securityfocus.com/archive/1/455202/100/0/threadedhttp://www.securityfocus.com/bid/21724http://www.securityfocus.com/bid/21725http://www.vupen.com/english/advisories/2006/5134http://www.zerodayinitiative.com/advisories/ZDI-06-052.htmlhttp://www.zerodayinitiative.com/advisories/ZDI-06-053.htmlhttps://secure-support.novell.com/KanisaPlatform/Publishing/134/3096026_f.SAL_Public.htmlhttp://secunia.com/advisories/23437http://securityreason.com/securityalert/2081http://securitytracker.com/id?1017437http://www.cirt.dk/advisories/cirt-48-advisory.txthttp://www.kb.cert.org/vuls/id/381161http://www.kb.cert.org/vuls/id/912505http://www.securityfocus.com/archive/1/455201/100/0/threadedhttp://www.securityfocus.com/archive/1/455202/100/0/threadedhttp://www.securityfocus.com/bid/21724http://www.securityfocus.com/bid/21725http://www.vupen.com/english/advisories/2006/5134http://www.zerodayinitiative.com/advisories/ZDI-06-052.htmlhttp://www.zerodayinitiative.com/advisories/ZDI-06-053.htmlhttps://secure-support.novell.com/KanisaPlatform/Publishing/134/3096026_f.SAL_Public.html
2006-12-27
Published