CVE-2006-2447
SpamAssassin - Remote Code Execution via Crafted Message with Virtual Pop Username
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2006-2447.
PoCs published by Metasploit, patrick, aushack, including Metasploit module exploits/unix/misc/spamassassin_exec.
AI-analyzed exploit summary This Metasploit module exploits CVE-2006-2447 in SpamAssassin's spamd service by injecting a malicious command into the User header when vpopmail and paranoid modes are enabled. It sends a crafted PROCESS SPAMC/1.2 request to execute arbitrary commands via the payload.
Description
SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.
Exploits (3)
This Metasploit module exploits CVE-2006-2447 in SpamAssassin's spamd service by injecting a malicious command into the User header when vpopmail and paranoid modes are enabled. It sends a crafted PROCESS SPAMC/1.2 request to execute arbitrary commands via the payload.
This exploit targets a command injection vulnerability in SpamAssassin's spamd service (CVE-2006-2447) by injecting a malicious command into the 'User' header when vpopmail and paranoid modes are enabled. It sends a crafted SPAMC request to execute arbitrary commands via the payload.
This Metasploit module exploits a command injection vulnerability in SpamAssassin's spamd service by injecting a malicious command into the 'User' header when vpopmail and paranoid modes are enabled. The exploit sends a crafted SPAMC request to trigger remote command execution.