« Volver al listado

CVE-2006-6424

Estado: ModificadaAlta (9)—

Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IMAP verbs when specifying command continuation requests to IMAPD, resulting in a heap overflow; and (2) via crafted arguments to the STOR command to the Network Messaging Application Protocol (NMAP) daemon, resulting in a stack overflow.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Novell — Netmail

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-6424",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-12-27T01:28:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/23437",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/2081",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1017437",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.cirt.dk/advisories/cirt-48-advisory.txt",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/381161",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/912505",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/455201/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/455202/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/21724",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/21725",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/5134",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-06-052.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-06-053.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://secure-support.novell.com/KanisaPlatform/Publishing/134/3096026_f.SAL_Public.html",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/23437",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/2081",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1017437",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.cirt.dk/advisories/cirt-48-advisory.txt",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/381161",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/912505",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/455201/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/455202/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/21724",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/21725",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/5134",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-06-052.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-06-053.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://secure-support.novell.com/KanisaPlatform/Publishing/134/3096026_f.SAL_Public.html",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IMAP verbs when specifying command continuation requests to IMAPD, resulting in a heap overflow; and (2) via crafted arguments to the STOR command to the Network Messaging Application Protocol (NMAP) daemon, resulting in a stack overflow."
    },
    {
      "lang": "es",
      "value": "Múltiples desbordamientos de búfer en Novell NetMail anterior a 3.52e FTF2 permiten a atacantes remotos ejecutar código de su elección (1) añadiendo literales a ciertos verbos IMAP cuando se especifican peticiones de continuación de comandos a IMAPD, resultando en un desbordamiento de montón; y (2) mediante argumentos manipulados del el comando STOR para el demonio del protocolo de aplicaciones de mensajería en red (Network Messaging Application Protocol o NMAP), resultando en un desbordamiento de pila."
    }
  ],
  "lastModified": "2026-06-16T22:33:06.310",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:novell:netmail:*:e-ftfl:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E8E5532-0649-431E-BB21-D5830FF20C50",
              "versionEndIncluding": "3.5.2"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "417FAC89-DD03-47E5-9743-FFD5E1AEC702"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.0.3a:a:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6159C3FC-F82D-42BC-903F-2720FEF61E5A"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.0.3a:b:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3E56419-E190-4249-8B9E-02DC20B5F2F8"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4332FF7C-B625-4885-84F1-95A210391A42"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.1:f:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0863DA2-AA27-4C91-B73A-649354FB2B8B"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B57CD26-1038-4959-B560-D5FE90D6A2A3"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6733B36D-1AB1-4F61-A99C-E14343E41BEF"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.10:a:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6D05531-78EF-46C7-A4F8-9CB0B077C207"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.10:b:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46767ECB-FD9A-478B-B983-85F6281F7F51"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.10:c:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7397E8D5-ECAE-4A89-8340-5576EE6551F8"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.10:d:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA5BFC56-D652-4252-8E68-30DE40CC5BB4"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.10:e:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB9A617E-75D2-45A6-ACF7-2A87A9803A18"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.10:f:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2CCBCB4F-5F8B-45CD-9007-DD0C7F90D59B"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.10:g:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5657411D-2C13-406B-9113-2580062CA486"
            },
            {
              "criteria": "cpe:2.3:a:novell:netmail:3.10:h:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D128B390-A46C-463E-9D97-D8AD0611191A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "evaluatorSolution": "Successful exploitation requires a valid user account.\r\nThis vulnerability is addressed in the following product update:\r\nNovell, NetMail, 3.52e FTF2"
}