CVE-2011-1926 The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a...
MediumCVSS 5.1
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cmu cyrus imap server | <= 2.4.6 | No fix listed |
| cmu cyrus imap server | = 2.0.17 | No fix listed |
| cmu cyrus imap server | = 2.1.16 | No fix listed |
| cmu cyrus imap server | = 2.1.17 | No fix listed |
| cmu cyrus imap server | = 2.1.18 | No fix listed |
| cmu cyrus imap server | = 2.2.8 | No fix listed |
| cmu cyrus imap server | = 2.2.9 | No fix listed |
| cmu cyrus imap server | = 2.2.10 | No fix listed |
| cmu cyrus imap server | = 2.2.11 | No fix listed |
| cmu cyrus imap server | = 2.2.12 | No fix listed |
| cmu cyrus imap server | = 2.2.13 | No fix listed |
| cmu cyrus imap server | = 2.2.13p1 | No fix listed |
| cmu cyrus imap server | = 2.3.0 | No fix listed |
| cmu cyrus imap server | = 2.3.1 | No fix listed |
| cmu cyrus imap server | = 2.3.2 | No fix listed |
| cmu cyrus imap server | = 2.3.3 | No fix listed |
| cmu cyrus imap server | = 2.3.4 | No fix listed |
| cmu cyrus imap server | = 2.3.5 | No fix listed |
| cmu cyrus imap server | = 2.3.6 | No fix listed |
| cmu cyrus imap server | = 2.3.7 | No fix listed |
| cmu cyrus imap server | = 2.3.8 | No fix listed |
| cmu cyrus imap server | = 2.3.9 | No fix listed |
| cmu cyrus imap server | = 2.3.10 | No fix listed |
| cmu cyrus imap server | = 2.3.11 | No fix listed |
| cmu cyrus imap server | = 2.3.12 | No fix listed |
Show 10 more
| Product | Affected versions | Fixed in |
|---|---|---|
| cmu cyrus imap server | = 2.3.13 | No fix listed |
| cmu cyrus imap server | = 2.3.14 | No fix listed |
| cmu cyrus imap server | = 2.3.15 | No fix listed |
| cmu cyrus imap server | = 2.3.16 | No fix listed |
| cmu cyrus imap server | = 2.4.0 | No fix listed |
| cmu cyrus imap server | = 2.4.1 | No fix listed |
| cmu cyrus imap server | = 2.4.2 | No fix listed |
| cmu cyrus imap server | = 2.4.3 | No fix listed |
| cmu cyrus imap server | = 2.4.4 | No fix listed |
| cmu cyrus imap server | = 2.4.5 | No fix listed |
References
- bugzilla.cyrusimap.org patch
- bugzilla.cyrusimap.org patch
- git.cyrusimap.org patch
- FEDORA-2011-7217 vendor-advisory
- FEDORA-2011-7193 vendor-advisory
- [oss-security] 20110517 Re: CVE Request -- Cyrus-IMAP STARTTLS issue -- [was: Re: pure-ftpd STARTTLS command injection / new CVE?] mailing-list patch
- [oss-security] 20110517 CVE Request -- Cyrus-IMAP STARTTLS issue -- [was: Re: pure-ftpd STARTTLS command injection / new CVE?] mailing-list patch
- 44670 third-party-advisory
- 44876 third-party-advisory
- 44913 third-party-advisory
- 44928 third-party-advisory
- www.cyrusimap.org
- DSA-2242 vendor-advisory
- DSA-2258 vendor-advisory
- VU#555316 third-party-advisory us-government-resource
- MDVSA-2011:100 vendor-advisory
- RHSA-2011:0859 vendor-advisory
- 1025625 vdb-entry
- bugzilla.redhat.com patch
- cyrus-starttls-command-exec(67867) vdb-entry