PT-2006-1688 · Erik C. Thauvin · Mailback

Erik C. Thauvin · Published 2006-02-10 · Updated 2017-07-20 · CVE-2006-0631

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions mailback versions (affected versions not specified)

Description The issue concerns a CRLF injection vulnerability in the mailback.pl script of Erik C. Thauvin's mailback. This vulnerability allows remote attackers to exploit mailback as a "spam proxy" by modifying mail headers. The modification can include changing recipient e-mail addresses via newline characters inserted in the Subject field.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-0631

Affected Products

Mailback

References · 8

• 🔥 http://seclists.org/lists/bugtraq/2006/Feb/0154.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0631 · Security Note
• http://osvdb.org/22955 · Patch
• http://secunia.com/advisories/18748 · Vendor Advisory
• http://vc.thauvin.net/cvs/cgi/mailback/mailback.pl?view=log · Note
• http://vupen.com/english/advisories/2006/0459 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24540 · Note
• http://seclists.org/lists/bugtraq/2006/Feb/0094.html · Note