Vulnerability Details : CVE-2006-0395
Public exploit exists!
The Download Validation in Mail in Mac OS X 10.4 does not properly recognize attachment file types to warn a user of an unsafe type, which allows user-assisted remote attackers to execute arbitrary code via crafted file types.
Vulnerability category: Execute code
Products affected by CVE-2006-0395
- cpe:2.3:o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x_server:10.4.5:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2006-0395
3.93%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 92 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2006-0395
-
Mail.app Image Attachment Command Execution
Disclosure Date: 2006-03-01First seen: 2020-04-26exploit/osx/email/mailapp_image_execThis module exploits a command execution vulnerability in the Mail.app application shipped with Mac OS X 10.5.0. This flaw was patched in 10.4 in March of 2007, but reintroduced into the final release of 10.5. Authors: - hdm <x@hdm.io> - kf <kf_list@digi
CVSS scores for CVE-2006-0395
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.1
|
MEDIUM | AV:N/AC:H/Au:N/C:P/I:P/A:P |
4.9
|
6.4
|
NIST |
References for CVE-2006-0395
-
http://www.vupen.com/english/advisories/2006/0791
-
http://docs.info.apple.com/article.html?artnum=303382
-
http://www.us-cert.gov/cas/techalerts/TA06-062A.html
US Government Resource
-
http://lists.apple.com/archives/client-management/2006/Mar/msg00030.html
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/25027
-
http://www.securityfocus.com/bid/16907
Apple Mac OS X Security Update 2006-001 Multiple Vulnerabilities
Jump to