CVE-2011-1431

https://notcve.org/view.php?id=CVE-2011-1431

The STARTTLS implementation in qmail-smtpd.c in qmail-smtpd in the netqmail-1.06-tls patch for netqmail 1.06 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411. La implementación qmail-smtpd.c en qmail-smtpd en el parche netqmail-1.06-tls para netqmail v1.06 no restringe el búfer I/O de forma adecuada, lo que permite a los atacantes "man-in-the-middle insertar comandos en las sesiones SMTP cifrado mediante el envío de un comando de texto plano que se procesa después de que TLS está en su lugar, relacionado con un ataque "inyección de de comando en texto claro", un problema similar a CVE -2011- 0411. • http://inoa.net/qmail-tls/vu555316.patch http://securityreason.com/securityalert/8144 http://www.kb.cert.org/vuls/id/555316 http://www.kb.cert.org/vuls/id/MAPG-8D9M5Q http://www.postfix.org/CVE-2011-0411.html http://www.securityfocus.com/archive/1/516901 http://www.securityfocus.com/bid/46767 http://www.vupen.com/english/advisories/2011/0612 https://exchange.xforce.ibmcloud.com/vulnerabilities/65932 •