CVE-2006-6425

published 2006-12-27

CVE-2006-6425: Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via…

Priority P2 63 critical 9 CVSS 2.0

AV N AC L Au S C C I C A C

EXPLOIT

Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via unspecified vectors involving the APPEND command.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
novell	netmail	<= 3.5.2	—
novell	netmail	—	—
novell	netmail	—	—
novell	netmail	—	—
novell	netmail	—	—
novell	netmail	—	—

Detection & IOCs extracted from sources · hover to see the quote

command a002 APPEND saved-messages (\Seen) <1358 bytes junk><payload><\xeb\x06><2 bytes junk><ret><\xe9 offset><150 bytes junk>↗

other 0x75022ac4↗

port 143↗

bytes↗

\xeb\x06

• → Detect oversized IMAP APPEND commands targeting Novell NetMail IMAPD; the exploit sends a malformed APPEND to 'saved-messages' with a payload offset of 1358 bytes before shellcode. ↗
• → Look for IMAP APPEND commands with excessively long arguments (>1358 bytes) on port 143 directed at Novell NetMail 3.52 servers, indicative of stack buffer overflow exploitation. ↗
• → The exploit requires prior authentication; monitor for authenticated IMAP sessions immediately followed by anomalously large APPEND commands as a lateral-movement or post-auth exploitation indicator. ↗
• → The exploit uses a short JMP (\xeb\x06) followed by a 4-byte return address and a near JMP (\xe9) for shellcode redirection; presence of these byte sequences within an IMAP APPEND payload is a strong exploit indicator. ↗

• · The published Metasploit module targets only Windows 2000 SP0-SP4 English with a hardcoded return address; exploitation against other OS versions or service packs requires a different return address. ↗
• · Payload space is constrained to 700 bytes and bad characters \x00, \x0a, \x0d, \x20 must be avoided; detection signatures should account for encoded payloads that avoid these bytes. ↗
• · The exploit uses EXITFUNC=thread, meaning the spawned shellcode exits via thread termination rather than process exit, which may affect post-exploitation forensic artifacts. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.