PT-2006-3724 · Apache · Apache James

Ahmad Muammar W.K + 1 · Published 2006-06-05 · Updated 2018-10-18 · CVE-2006-2806

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Java Mail Enterprise Server (aka Apache James) version 2.2.0

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by sending a long argument to the MAIL command in the SMTP server.

Recommendations For Apache Java Mail Enterprise Server (aka Apache James) version 2.2.0, consider restricting access to the SMTP server or limiting the length of arguments to the MAIL command as a temporary workaround until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2006-2806

Affected Products

Apache James

References · 6

• 🔥 http://advisories.echo.or.id/adv/adv31-y3dips-2006.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2806 · Security Note
• http://securityfocus.com/bid/18138 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26786 · Note
• http://securityfocus.com/archive/1/435278/100/0/threaded · Note
• http://securityreason.com/securityalert/1038 · Note