CVE ID:	CVE-2006-2447
Description:	SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.
Test IDs:	1.3.6.1.4.1.25623.1.0.59317   1.3.6.1.4.1.25623.1.0.56952   1.3.6.1.4.1.25623.1.0.65543   1.3.6.1.4.1.25623.1.0.59318   1.3.6.1.4.1.25623.1.0.56941   1.3.6.1.4.1.25623.1.0.56885   1.3.6.1.4.1.25623.1.0.62407   1.3.6.1.4.1.25623.1.0.56936   1.3.6.1.4.1.25623.1.0.56890
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2006-2447 Bugtraq: 20060607 rPSA-2006-0096-1 spamassassin (Google Search) http://www.securityfocus.com/archive/1/archive/1/436288/100/0/threaded Debian Security Information: DSA-1090 (Google Search) http://www.debian.org/security/2006/dsa-1090 http://www.gentoo.org/security/en/glsa/glsa-200606-09.xml http://www.mandriva.com/security/advisories?name=MDKSA-2006:103 RedHat Security Advisories: RHSA-2006:0543 http://www.redhat.com/support/errata/RHSA-2006-0543.html http://www.trustix.org/errata/2006/0034/ BugTraq ID: 18290 http://www.securityfocus.com/bid/18290 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9184 http://www.vupen.com/english/advisories/2006/2148 http://securitytracker.com/id?1016230 http://securitytracker.com/id?1016235 http://secunia.com/advisories/20443 http://secunia.com/advisories/20430 http://secunia.com/advisories/20482 http://secunia.com/advisories/20531 http://secunia.com/advisories/20566 http://secunia.com/advisories/20692 XForce ISS Database: spamassassin-spamd-command-execution(27008) http://xforce.iss.net/xforce/xfdb/27008

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: