CVE-2006-6424: Novell NetMail IMAPD and NMAP daemon buffer overflows allow remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with complete confidentiality, integrity, and availability impact, though authentication is required and no confirmed in-the-wild exploitation is documented.

What it is

Novell NetMail before 3.52e FTF2 contains multiple buffer overflows: a heap overflow in IMAPD triggered by appending literals to certain IMAP verbs during command continuation requests, and a stack overflow in the NMAP daemon via crafted STOR command arguments. Both flaws allow remote code execution, making them serious for any internet-exposed mail server.

Impact

An attacker can execute arbitrary code on the mail server, likely with the privileges of the IMAPD or NMAP daemon process, leading to full compromise of the messaging service and its data.

Attack surface

Reachable over the network via the IMAP and NMAP service ports; the CVSS vector indicates authentication is required (Au:S), and no user interaction is needed beyond sending crafted protocol commands.

Exploitation

Not listed in CISA KEV and no public exploit tags in the references, but EPSS is very high (0.59, 99th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Upgrade Novell NetMail to version 3.52e FTF2 or later, applying the vendor patch referenced in the advisories.
• Restrict network access to IMAP and NMAP ports to trusted hosts or VPN where possible.
• Disable or block the NMAP daemon if it is not required for messaging operations.
• Monitor vendor and CERT/CC advisories for any updated guidance on the affected components.

Detection

• Inspect IMAPD logs for malformed command continuation requests or unusual literal appends to IMAP verbs.
• Monitor NMAP daemon logs for STOR commands with abnormally long or crafted arguments.
• Watch for unexpected process crashes or restarts of IMAPD or NMAP services that could indicate exploitation attempts.
• Use network IDS signatures for buffer overflow patterns against IMAP and NMAP traffic if available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.