PT-2006-7034 · Novell · Novell Netmail

Published 2006-12-27 · Updated 2018-10-17 · CVE-2006-6425

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Novell NetMail versions prior to 3.52e FTF2

Description The issue is related to a stack-based buffer overflow in the IMAP daemon (IMAPD) that allows remote authenticated users to execute arbitrary code. This is achieved through unspecified vectors involving the APPEND command.

Recommendations For versions prior to 3.52e FTF2, update to version 3.52e FTF2 or later to resolve the issue. As a temporary workaround, consider restricting access to the IMAP daemon (IMAPD) to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-6425

Affected Products

Novell Netmail

References · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/imap/novell_netmail_append.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16488 · Exploit
• http://securitytracker.com/id?1017437 · Patch
• http://secunia.com/advisories/23437 · Vendor Advisory
• https://secure-support.novell.com/KanisaPlatform/Publishing/134/3096026_f.SAL_Public.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-6425 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-06-054.html · Vendor Advisory
• http://securityreason.com/securityalert/2080 · Note
• http://kb.cert.org/vuls/id/258753 · Note
• http://vupen.com/english/advisories/2006/5134 · Note
• http://securityfocus.com/archive/1/455200/100/0/threaded · Note
• http://securityfocus.com/bid/21723 · Note