// For flags

CVE-2014-3556

HP Security Bulletin HPSBOV03227

Severity Score

8.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.

La implementación STARTTLS en mail/ngx_mail_smtp_handler.c en el proxy SMTP en nginx 1.5.x y 1.6.x anterior a 1.6.1 y 1.7.x anterior a 1.7.4 no restringe adecuadamente el buffer I/O, lo que permite ataques man-in-the-middle insertar comandos en sesiones cifradas SMTP enviando el comando cleartext que se procesa después que TLS, relacionado a un ataque 'inyección de comando de texto plano', un problema similar a CVE-2011-0411

Potential security vulnerabilities have been identified with HP SSL for OpenVMS. These vulnerabilities could be remotely exploited to create a remote disclosure of information, Denial of Service, and other vulnerabilities. Revision 1 of this advisory.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2014-05-14 CVE Reserved
  • 2014-12-29 CVE Published
  • 2024-08-06 CVE Updated
  • 2025-05-25 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
F5
Search vendor "F5"
 Nginx
Search vendor "F5" for product "Nginx"
 >= 1.5.6 < 1.6.1
Search vendor "F5" for product "Nginx" and version " >= 1.5.6 < 1.6.1"
-
Affected
F5
Search vendor "F5"
 Nginx
Search vendor "F5" for product "Nginx"
 >= 1.7.0 < 1.7.4
Search vendor "F5" for product "Nginx" and version " >= 1.7.0 < 1.7.4"
-
Affected