CVE-2012-3523 The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a clea...
MediumCVSS 6.8
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/inn2(Debian:12) | < 2.5.3-1 | 2.5.3-1 |
| debian/inn2(Debian:13) | < 2.5.3-1 | 2.5.3-1 |
| debian/inn2(Debian:14) | < 2.5.3-1 | 2.5.3-1 |
| isc inn | <= 2.5.2 | No fix listed |
| isc inn | = 1.4 | No fix listed |
| isc inn | = 1.4sec | No fix listed |
| isc inn | = 1.4sec2 | No fix listed |
| isc inn | = 1.4unoff3 | No fix listed |
| isc inn | = 1.4unoff4 | No fix listed |
| isc inn | = 1.5 | No fix listed |
| isc inn | = 1.5.1 | No fix listed |
| isc inn | = 1.7 | No fix listed |
| isc inn | = 1.7.2 | No fix listed |
| isc inn | = 2.0 | No fix listed |
| isc inn | = 2.1 | No fix listed |
| isc inn | = 2.2 | No fix listed |
| isc inn | = 2.2.1 | No fix listed |
| isc inn | = 2.2.2 | No fix listed |
| isc inn | = 2.2.3 | No fix listed |
| isc inn | = 2.4.0 | No fix listed |
References
- Debian Security Tracker CVE-2012-3523 vendor-advisory
- openSUSE-SU-2012:1171 vendor-advisory
- 50661 third-party-advisory
- MDVSA-2012:156 vendor-advisory
- bugs.debian.org issue-tracking