Published: 23/05/2011 Updated: 30/10/2018

CVSS v2 Base Score: 5.1 | Impact Score: 6.4 | Exploitability Score: 4.9

VMScore: 454

Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P

The STARTTLS implementation in Cyrus IMAP Server prior to 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle malicious users to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cmu cyrus imap server 2.4.2
cmu cyrus imap server 2.4.1
cmu cyrus imap server 2.4.0
cmu cyrus imap server 2.3.3
cmu cyrus imap server 2.3.2
cmu cyrus imap server 2.3.1
cmu cyrus imap server 2.3.0
cmu cyrus imap server 2.1.16
cmu cyrus imap server 2.3.11
cmu cyrus imap server 2.0.17
cmu cyrus imap server
cmu cyrus imap server 2.4.5
cmu cyrus imap server 2.3.7
cmu cyrus imap server 2.3.6
cmu cyrus imap server 2.3.12
cmu cyrus imap server 2.2.12
cmu cyrus imap server 2.2.11
cmu cyrus imap server 2.3.16
cmu cyrus imap server 2.3.14
cmu cyrus imap server 2.2.13
cmu cyrus imap server 2.3.9
cmu cyrus imap server 2.3.8
cmu cyrus imap server 2.3.15
cmu cyrus imap server 2.3.13
cmu cyrus imap server 2.2.9
cmu cyrus imap server 2.2.8
cmu cyrus imap server 2.1.18
cmu cyrus imap server 2.2.13p1
cmu cyrus imap server 2.4.4
cmu cyrus imap server 2.4.3
cmu cyrus imap server 2.3.5
cmu cyrus imap server 2.3.4
cmu cyrus imap server 2.3.10
cmu cyrus imap server 2.2.10
cmu cyrus imap server 2.1.17

Debian Bug report logs - #627081 STARTTLS plaintext command injection Package: cyrus-imapd-22; Maintainer for cyrus-imapd-22 is (unknown); Reported by: Moritz Muehlenhoff <muehlenhoff@univentionde> Date: Tue, 17 May 2011 15:03:05 UTC Severity: grave Tags: lenny, security, sid, squeeze Found in versions cyrus-imapd-22/ ...

It was discovered that the STARTTLS implementation of the Kolab Cyrus IMAP server does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted IMAP, LMTP, NNTP and POP3 sessions by sending a cleartext command that is processed after TLS is in place For the oldstable distribution (lenny), this ...

CWE-264 http://bugzilla.cyrusimap.org/show_bug.cgi?id=3423 http://www.kb.cert.org/vuls/id/555316 http://www.cyrusimap.org/docs/cyrus-imapd/2.4.7/changes.php https://bugzilla.redhat.com/show_bug.cgi?id=705288 http://openwall.com/lists/oss-security/2011/05/17/15 http://bugzilla.cyrusimap.org/show_bug.cgi?id=3424 http://openwall.com/lists/oss-security/2011/05/17/2 http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162 http://www.debian.org/security/2011/dsa-2242 http://www.mandriva.com/security/advisories?name=MDVSA-2011:100 http://secunia.com/advisories/44670 http://secunia.com/advisories/44913 http://www.debian.org/security/2011/dsa-2258 http://www.redhat.com/support/errata/RHSA-2011-0859.html http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061415.html http://www.securitytracker.com/id?1025625 http://secunia.com/advisories/44928 http://secunia.com/advisories/44876 http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061374.html https://exchange.xforce.ibmcloud.com/vulnerabilities/67867 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=627081 https://nvd.nist.gov https://www.debian.org/security/./dsa-2258

CVE-2011-1926

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect