Description
The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
References (3)
Core 3
Core References
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2012:156
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/50661
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2012-09/msg00058.html
Scores
EPSS
0.1881
EPSS Percentile
95.4%
Details
CWE
CWE-264
Status
published
Products (17)
isc/inn
1.4
isc/inn
1.4sec
isc/inn
1.4sec2
isc/inn
1.4unoff3
isc/inn
1.4unoff4
isc/inn
1.5
isc/inn
1.5.1
isc/inn
1.7
isc/inn
1.7.2
isc/inn
2.0
... and 7 more
Published
Nov 11, 2012
Tracked Since
Feb 18, 2026