CVE-2006-2447: SpamAssassin vpopmail paranoid mode command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote code execution with no authentication required, though it depends on a specific vpopmail and paranoid-mode configuration, and EPSS is very high.

What it is

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, fails to properly handle the virtual pop username when invoking spamd, allowing command injection. A crafted message can cause arbitrary command execution on the mail server. This matters because it turns a mail-processing path into remote code execution on systems using that specific configuration.

Impact

An attacker can execute arbitrary commands with the privileges of the spamd process, potentially compromising the mail server. This can lead to data theft, further lateral movement, or service disruption.

Attack surface

The flaw is reached remotely by sending a crafted email message to a SpamAssassin instance configured with vpopmail and the paranoid (-P) switch. No authentication is required, and no user interaction is needed beyond message delivery.

Exploitation

The record is not listed in CISA KEV and has no exploit tags in references, but EPSS is very high (0.7581, 99.5th percentile), indicating elevated predicted exploitation likelihood. No public exploit details are provided in the record.

What to do

• Upgrade SpamAssassin to 3.1.3 or later, applying vendor patches referenced in the advisories.
• If immediate patching is not possible, disable the paranoid (-P) switch or avoid running spamd with vpopmail in that mode.
• Restrict network access to spamd so only trusted mail transfer agents can reach it.
• Run spamd with least privilege and isolate it from sensitive system resources.
• Monitor vendor advisories for distribution-specific patches (Debian, Red Hat, Gentoo, Mandriva, Trustix).

Detection

• Inspect spamd process command lines for the -P switch combined with vpopmail configuration.
• Monitor for unexpected child processes or shell commands spawned by spamd.
• Review mail logs for anomalous messages that trigger spamd errors or unusual username handling.
• Audit systems for SpamAssassin versions prior to 3.1.3 using package managers or version checks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.