PT-2011-3481 · Cyrus+1 · Cyrus Imap Server+1

Jan Lieskovsky

·

Publicado

2011-05-23

·

Atualizado

2018-10-30

·

CVE-2011-1926

CVSS v2.0

5.1

Média

VetorAV:N/AC:H/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Cyrus IMAP Server versions prior to 2.4.7
Description The issue is related to a "plaintext command injection" attack, where man-in-the-middle attackers can insert commands into encrypted sessions. This occurs because the STARTTLS implementation does not properly restrict I/O buffering, allowing attackers to send a cleartext command that is processed after TLS is in place.
Recommendations For versions prior to 2.4.7, update to version 2.4.7 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and minimizing the use of cleartext commands in encrypted sessions until the update is applied.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-1926
DSA-2242-1
DSA-2258-1
RHSA-2011:0859
RHSA-2011_0859

Produtos afetados

Cyrus Imap Server
Red Hat