SpamAssassin spamd vpopmail user vulnerability

Added: 06/09/2006 CVE: CVE-2006-2447 BID: 18290 OSVDB: 26177 Background SpamAssassin identifies spam e-mail using a variety of local and network based tests. spamd is a component of SpamAssassin which allows it to run as a network daemon. Problem When the vpopmail -v and paranoid -P options are...

SpamAssassin spamd vpopmail Username Command Injection

Binary data 3640.prm...

SpamAssassin spamd Crafted Message Arbitrary Command Execution

The remote host is running spamd, a daemon belonging to SpamAssassin and used to determine whether messages represent spam. The installed version of spamd on the remote host appears to allow an unauthenticated user to execute arbitrary commands, subject to the privileges of the user under which i...

RHEL 4 : spamassassin (RHSA-2006:0543)

Updated spamassassin packages that fix an arbitrary code execution flaw are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SpamAssassin provides a way to reduce unsolicited commercial email SPAM from incoming email. A flaw was...

spamassassin security update

CentOS Errata and Security Advisory CESA-2006:0543 Updated spamassassin packages that fix an arbitrary code execution flaw are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SpamAssassin provides a way to reduce unsolicited...

Design/Logic Flaw

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid -P switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username...

DEBIAN-CVE-2006-2447

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid -P switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username...

CVE-2006-2447

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid -P switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username...

CVE-2006-2447

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid -P switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username...

CVE-2006-2447

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid -P switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username...

CVE-2006-2447

CVE-2006-2447 affects SpamAssassin spamd prior to 3.1.3 when run with vpopmail (--vpopmail) and paranoid (--paranoid) options. A crafted message sent to the spamd daemon can cause remote execution of arbitrary commands in the spamd process’ user context. Public references describe multiple adviso...

CVE-2006-2447

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid -P switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username...

CVE-2006-2447

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid -P switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username...

Moderate: Red Hat Security Advisory: spamassassin security update

Updated spamassassin packages that fix an arbitrary code execution flaw are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SpamAssassin provides a way to reduce unsolicited commercial email SPAM from incoming email. A flaw was...

security flaw

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid -P switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username...

[SECURITY] [DSA 1090-1] New spamassassin packages fix remote command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1090-1 [email protected] http://www.debian.org/security/ Martin Schulze June 6th, 2006 http://www.debian.org/security/faq -...

DSA-1090-1 spamassassin - programming error

Bulletin has no description...

SpamAssassin spamd <= 3.1.3 Command Injection

No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...

[Full-disclosure] [SECURITY] [DSA 1090-1] New spamassassin packages fix remote command execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1090-1 [email protected] http://www.debian.org/security/ Martin Schulze June 6th, 2006 http://www.debian.org/security/faq -...

SpamAssassin spamd Remote Command Execution

This module exploits a flaw in the SpamAssassin spamd service by specifying a malicious vpopmail User header, when running with vpopmail and paranoid modes enabled non-default. Versions prior to v3.1.3 are vulnerable Module Options msf use exploit/unix/misc/spamassassin/exec msf undefinedexec sho...