PT-2006-7362 · Novell · Novell Netmail

Dennis Rand · Published 2006-12-27 · Updated 2011-03-08 · CVE-2006-6761

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Novell NetMail versions prior to 3.52e FTF2

Description: The issue is related to a stack-based buffer overflow in the IMAP daemon. This occurs when a long argument is passed to the SUBSCRIBE command, allowing remote authenticated users to execute arbitrary code.

Recommendations: For versions prior to 3.52e FTF2, update to version 3.52e FTF2 or later to resolve the issue. As a temporary workaround, consider restricting access to the SUBSCRIBE command in the IMAP daemon until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2006-6761

Affected Products

Novell Netmail

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/imap/novell_netmail_subscribe.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16478 · Exploit
• 🔥 http://secunia.com/advisories/23437 · Exploit
• http://securitytracker.com/id?1017437 · Patch
• https://secure-support.novell.com/KanisaPlatform/Publishing/328/3717068_f.SAL_Public.html · Patch
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=454 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-6761 · Security Note
• http://securityfocus.com/bid/21728 · Patch
• http://vupen.com/english/advisories/2006/5134 · Note
• http://kb.cert.org/vuls/id/863313 · Note