CVE-2006-0447
CVE-2006-0447 is a high-severity vulnerability in E-post Corporation Mail Server with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 2.0 base score 7.5)
- EPSS exploit prediction: 5% (91st percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: E-post Corporation Mail Server
- Published:
- Last modified:
Description
Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username to the (1) AUTH PLAIN or (2) AUTH LOGIN SMTP commands, which is not properly handled by (a) EPSTRS.EXE or (b) SPA-RS.EXE; (3) a long username in the APOP POP3 command, which is not properly handled by (c) EPSTPOP4S.EXE or (d) SPA-POP3S.EXE; (4) a long IMAP DELETE command, which is not properly handled by (e) EPSTIMAP4S.EXE or (f) SPA-IMAP4S.EXE.
Frequently asked questions
- What is CVE-2006-0447?
- Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username to the (1) AUTH PLAIN or (2) AUTH LOGIN SMTP commands, which is not properly handled by (a) EPSTRS.EXE or (b) SPA-RS.EXE; (3) a long username in the APOP POP3 command, which is not properly handled by (c) EPSTPOP4S.EXE or (d) SPA-POP3S.EXE; (4) a long IMAP DELETE command, which is not properly handled by (e) EPSTIMAP4S.EXE or (f) SPA-IMAP4S.EXE.
- How severe is CVE-2006-0447?
- CVE-2006-0447 has a CVSS 2.0 base score of 7.5, rated high severity.
- Is CVE-2006-0447 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 5% (91st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2006-0447?
- CVE-2006-0447 primarily affects E-post Corporation Mail Server. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2006-0447?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2006-0447 published?
- CVE-2006-0447 was published on 2006-01-27 and last updated on 2026-06-16.
References
- http://secunia.com/advisories/18480
- http://secunia.com/secunia_research/2006-1/advisory/
- http://www.osvdb.org/22761
- http://www.osvdb.org/22762
- http://www.osvdb.org/22763
- http://www.securityfocus.com/bid/16379
- http://www.vupen.com/english/advisories/2006/0318
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24331
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24333
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24334
Affected products (6)
- cpe:2.3:a:e-post_corporation:mail_server:4.10:*:*:*:*:*:*:*
- cpe:2.3:a:e-post_corporation:mail_server:enterprise_4.10:*:*:*:*:*:*:*
- cpe:2.3:a:e-post_corporation:smtp_server:4.10:*:*:*:*:*:*:*
- cpe:2.3:a:e-post_corporation:smtp_server:enterprise_4.10:*:*:*:*:*:*:*
- cpe:2.3:a:e-post_corporation:spa-pro_mail_atsolomon:4.00:*:*:*:*:*:*:*
- cpe:2.3:a:e-post_corporation:spa-pro_mail_atsolomon:enterprise_4.00:*:*:*:*:*:*:*
More vulnerabilities in E-post Corporation Mail Server
- CVE-2006-0448 — High (CVSS 7.5): Multiple directory traversal vulnerabilities in (1) EPSTIMAP4S.EXE and (2) SPA-IMAP4S.EXE in the IMAP service in E-Post…
- CVE-2006-0449 — Medium (CVSS 5.0): Early termination vulnerability in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allows remote attackers…
- CVE-2008-2049 — Medium (CVSS 4.3): The POP3 server (EPSTPOP3S.EXE) 4.22 in E-Post Mail Server 4.10 allows remote attackers to obtain sensitive information…