CVE Feed

Dashboard / CVE / CVE-2006-0855

CVE-2006-0855

Stack-based buffer overflow in the fullpath function in misc.c for zoo 2.10 and earlier, as used in products such as Barracuda Spam Firewall, allows user-assisted attackers to execute arbitrary code via a crafted ZOO file that causes the combine function to return a longer string than expected.

Published:Feb 23, 2006

Last Modified:Apr 16, 2026

EPS:Feb 23, 2006

EPSS Score:0.02219

CVSS Score:5.1

Affected Products

Vendor

Product

Action

Vendor

Rahul Dhesi

Product

Zoo

Rahul Dhesi

Zoo

Exploits

http://archives.neohapsis.com/archives/bugtraq/2006-04/0061.html http://www.guay-leroux.com/projects/barracuda-advisory-ZOO.txt http://www.guay-leroux.com/projects/zoo-advisory.txt http://archives.neohapsis.com/archives/bugtraq/2006-04/0061.html http://www.guay-leroux.com/projects/barracuda-advisory-ZOO.txt http://www.guay-leroux.com/projects/zoo-advisory.txt

Common Weakness Enumeration

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-10 Buffer Overflow via Environment Variables

CAPEC-100 Overflow Buffers

CAPEC-123 Buffer Manipulation

CAPEC-14 Client-side Injection-induced Buffer Overflow

CAPEC-24 Filter Failure through Buffer Overflow

CAPEC-42 MIME Conversion

CAPEC-44 Overflow Binary Resource File

CAPEC-45 Buffer Overflow via Symbolic Links

CAPEC-46 Overflow Variables and Tags

CAPEC-47 Buffer Overflow via Parameter Expansion

CAPEC-8 Buffer Overflow in an API Call

CAPEC-9 Buffer Overflow in Local Command-Line Utilities

Related CVEs

CVE-2007-1673 (CVSS 7.8) — unzoo.c, as used in multiple products including AMaViS 2.4.1 and earlier, allows remote attackers to cause a d…

CVE-2006-1269 (CVSS 6.2) — Buffer overflow in the parse function in parse.c in zoo 2.10 might allow local users to execute arbitrary code…

References

http://archives.neohapsis.com/archives/bugtraq/2006-04/0061.html

http://secunia.com/advisories/19002

http://secunia.com/advisories/19130

http://secunia.com/advisories/19148

http://secunia.com/advisories/19166

http://secunia.com/advisories/19408

http://secunia.com/advisories/19514

http://securityreason.com/securityalert/546

http://securitytracker.com/id?1015668

http://securitytracker.com/id?1015866

http://www.debian.org/security/2006/dsa-991

http://www.gentoo.org/security/en/glsa/glsa-200603-05.xml

http://www.guay-leroux.com/projects/barracuda-advisory-ZOO.txt

http://www.guay-leroux.com/projects/zoo-advisory.txt

http://www.novell.com/linux/security/advisories/2006_05_sr.html

http://www.novell.com/linux/security/advisories/2006_06_sr.html

http://www.securityfocus.com/archive/1/425887/100/0/threaded

http://www.securityfocus.com/bid/16790

http://www.vupen.com/english/advisories/2006/0705

http://www.vupen.com/english/advisories/2006/1220

https://exchange.xforce.ibmcloud.com/vulnerabilities/24904

http://archives.neohapsis.com/archives/bugtraq/2006-04/0061.html

http://secunia.com/advisories/19002

http://secunia.com/advisories/19130

http://secunia.com/advisories/19148

http://secunia.com/advisories/19166

http://secunia.com/advisories/19408

http://secunia.com/advisories/19514

http://securityreason.com/securityalert/546

http://securitytracker.com/id?1015668

http://securitytracker.com/id?1015866

http://www.debian.org/security/2006/dsa-991

http://www.gentoo.org/security/en/glsa/glsa-200603-05.xml

http://www.guay-leroux.com/projects/barracuda-advisory-ZOO.txt

http://www.guay-leroux.com/projects/zoo-advisory.txt

http://www.novell.com/linux/security/advisories/2006_05_sr.html

http://www.novell.com/linux/security/advisories/2006_06_sr.html

http://www.securityfocus.com/archive/1/425887/100/0/threaded

http://www.securityfocus.com/bid/16790

http://www.vupen.com/english/advisories/2006/0705

http://www.vupen.com/english/advisories/2006/1220

https://exchange.xforce.ibmcloud.com/vulnerabilities/24904

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High