Lucene search

[email protected]CVE-2006-0630

HistoryFeb 10, 2006 - 11:02 a.m.

CVE-2006-0630

2006-02-1011:02:00

[email protected]

web.nvd.nist.gov

ritlabs

the bat!

cve-2006-0630

rfc2046

email spoofing

security vulnerability

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

6.6 Medium

AI Score

Confidence

High

0.042 Low

EPSS

Percentile

92.3%

JSON

RITLabs The Bat! before 3.0.0.15 displays certain important headers from encapsulated data in message/partial MIME messages, instead of the real headers, which is in violation of RFC2046 header merging rules and allows remote attackers to spoof the origin of e-mail by sending a fragmented message, as demonstrated using spoofed Received: and Message-ID: headers.

Affected configurations

NVD

Node

ritlabsthe_batMatch3.0

ritlabsthe_batMatch3.0.0.7

ritlabsthe_batMatch3.0.0.8

ritlabsthe_batMatch3.0.0.9

ritlabsthe_batMatch3.0.0.10

ritlabsthe_batMatch3.0.0.11

ritlabsthe_batMatch3.0.0.12

ritlabsthe_batMatch3.0.0.14

CPENameOperatorVersion
ritlabs:the_batritlabs the bateq3.0
ritlabs:the_batritlabs the bateq3.0.0.7
ritlabs:the_batritlabs the bateq3.0.0.8
ritlabs:the_batritlabs the bateq3.0.0.9
ritlabs:the_batritlabs the bateq3.0.0.10
ritlabs:the_batritlabs the bateq3.0.0.11
ritlabs:the_batritlabs the bateq3.0.0.12
ritlabs:the_batritlabs the bateq3.0.0.14

CPE	Name	Operator	Version
ritlabs:the_bat	ritlabs the bat	eq	3.0
ritlabs:the_bat	ritlabs the bat	eq	3.0.0.7
ritlabs:the_bat	ritlabs the bat	eq	3.0.0.8
ritlabs:the_bat	ritlabs the bat	eq	3.0.0.9
ritlabs:the_bat	ritlabs the bat	eq	3.0.0.10
ritlabs:the_bat	ritlabs the bat	eq	3.0.0.11
ritlabs:the_bat	ritlabs the bat	eq	3.0.0.12
ritlabs:the_bat	ritlabs the bat	eq	3.0.0.14

References

lists.grok.org.uk/pipermail/full-disclosure/2006-February/041973.html

secunia.com/advisories/18713

www.security.nnov.ru/advisories/thebatspoof.asp

www.securityfocus.com/archive/1/424129/100/0/threaded

www.securityfocus.com/bid/16515

exchange.xforce.ibmcloud.com/vulnerabilities/24535

www.ritlabs.com/bt/bug_view_advanced_page.php?bug_id=0003029

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

6.6 Medium

AI Score

Confidence

High

0.042 Low

EPSS

Percentile

92.3%

JSON

Related for CVE-2006-0630

nvd1 prion1 cvelist1