CVE-2006-0630 RITLabs The Bat! before 3.0.0.15 displays certain important headers from encapsulated data in message/partial MIME messages, instead of the real headers, which is in violation of RFC2046 header mergin...
MediumCVSS 5.0
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
RITLabs The Bat! before 3.0.0.15 displays certain important headers from encapsulated data in message/partial MIME messages, instead of the real headers, which is in violation of RFC2046 header merging rules and allows remote attackers to spoof the origin of e-mail by sending a fragmented message, as demonstrated using spoofed Received: and Message-ID: headers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ritlabs the bat | = 3.0 | No fix listed |
| ritlabs the bat | = 3.0.0.7 | No fix listed |
| ritlabs the bat | = 3.0.0.8 | No fix listed |
| ritlabs the bat | = 3.0.0.9 | No fix listed |
| ritlabs the bat | = 3.0.0.10 | No fix listed |
| ritlabs the bat | = 3.0.0.11 | No fix listed |
| ritlabs the bat | = 3.0.0.12 | No fix listed |
| ritlabs the bat | = 3.0.0.14 | No fix listed |
References
- 20060206 SECURITY.NNOV: The Bat! 2.x message headers spoofing mailing-list
- 18713 third-party-advisory
- www.security.nnov.ru exploit vendor-advisory
- 20060206 SECURITY.NNOV: The Bat! 2.x message headers spoofing mailing-list
- 16515 vdb-entry
- thebat-message-header-spoofing(24535) vdb-entry
- www.ritlabs.com