1. CVE-Search
  2. CVE-2006-6424
ID CVE-2006-6424
Summary Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IMAP verbs when specifying command continuation requests to IMAPD, resulting in a heap overflow; and (2) via crafted arguments to the STOR command to the Network Messaging Application Protocol (NMAP) daemon, resulting in a stack overflow. Successful exploitation requires a valid user account. This vulnerability is addressed in the following product update: Novell, NetMail, 3.52e FTF2
References
Vulnerable Configurations
  • cpe:2.3:a:novell:netmail:3.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.0.3a:a:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.0.3a:a:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.0.3a:b:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.0.3a:b:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.1:*:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.1:f:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.1:f:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.5:*:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:*:e-ftfl:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:*:e-ftfl:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.10:*:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.10:*:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.10:a:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.10:a:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.10:b:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.10:b:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.10:c:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.10:c:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.10:d:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.10:d:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.10:e:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.10:e:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.10:f:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.10:f:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.10:g:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.10:g:*:*:*:*:*:*
  • cpe:2.3:a:novell:netmail:3.10:h:*:*:*:*:*:*
    cpe:2.3:a:novell:netmail:3.10:h:*:*:*:*:*:*
CVSS
Base: 9.0 (as of 17-10-2018 - 21:48)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:S/C:C/I:C/A:C
refmap via4
bid
  • 21724
  • 21725
bugtraq
  • 20061223 ZDI-06-052: Novell NetMail NMAP STOR Buffer Overflow Vulnerability
  • 20061223 ZDI-06-053: Novell NetMail IMAP Verb Literal Heap Overflow Vulnerability
cert-vn
  • VU#381161
  • VU#912505
confirm https://secure-support.novell.com/KanisaPlatform/Publishing/134/3096026_f.SAL_Public.html
misc
sectrack 1017437
secunia 23437
sreason 2081
vupen ADV-2006-5134
saint via4
bid 21725
description Novell NetMail NMAP STOR command buffer overflow
id mail_imap_netmailneg
osvdb 31363
title netmail_nmap_stor
type remote
Last major update 17-10-2018 - 21:48
Published 27-12-2006 - 01:28
Last modified 17-10-2018 - 21:48
Back to Top