What is CVE-2006-2447?

CVE-2006-2447 is a vulnerability in N/a. Published 2006-06-06.

Is CVE-2006-2447 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in N/a

CVE-2006-2447

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.

EPSS: 0.758 (98.9th percentile) — read the EPSS interpretation.

Affected products

N/a — versions n/a

Public proof-of-concept exploits

rapid7/metasploit-framework

References

20482 (x_refsource_SECUNIA, third-party-advisory)
20060607 rPSA-2006-0096-1 spamassassin (mailing-list, x_refsource_BUGTRAQ)
oval:org.mitre.oval:def:9184 (signature, x_refsource_OVAL, vdb-entry)
2006-0034 (vendor-advisory, x_refsource_TRUSTIX)
GLSA-200606-09 (vendor-advisory, x_refsource_GENTOO)
20692 (x_refsource_SECUNIA, third-party-advisory)
20566 (x_refsource_SECUNIA, third-party-advisory)
18290 (vdb-entry, x_refsource_BID)
20430 (x_refsource_SECUNIA, third-party-advisory)
www.nabble.com/ANNOUNCE:-Apache-SpamAssassin-3.1.3-available!-t1736096.html (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2006-2447?: CVE-2006-2447 is a vulnerability in N/a. Published 2006-06-06.
Is CVE-2006-2447 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.