Unscored severity · published Jun 6, 2006
CVE-2006-2447
SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not…
–
CVSS
75.8%
EPSS
No
On KEV
Description
SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.
Exploitation
Is it being used?
Exploit prediction (EPSS)75.8% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Spamassassin · Apache
3.1.0; 3.1.1; 3.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-2447
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-2447
Patch
http://secunia.com/advisories/20430
Patch
http://secunia.com/advisories/20443
Vendor Advisory
http://secunia.com/advisories/20482
Vendor Advisory
http://secunia.com/advisories/20531
Vendor Advisory
http://secunia.com/advisories/20566
Vendor Advisory
http://secunia.com/advisories/20692
More from Spamassassin
9.8
CVE-2020-1946
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors
9.8
CVE-2018-11780
A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2
8.1
CVE-2020-1931
A command execution issue was found in Apache SpamAssassin prior to 3.4.3
8.1
CVE-2020-1930
A command execution issue was found in Apache SpamAssassin prior to 3.4.3
7.8
CVE-2018-11781
Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax