CVE-2012-3523

🗓️ 11 Nov 2012 11:00:00Reported by Debian Security Bug TrackerType

The STARTTLS implementation in nnrpd in INN before 2.5.3 vulnerability allows plaintext command injection during encrypted session

Reporter	Title	Published	Views	Family All 24
BDU FSTEC	The vulnerability of the Gentoo Linux operating system allows a malicious intruder to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
CVE	CVE-2012-3523	11 Nov 201211:00	–	cve
Cvelist	CVE-2012-3523	11 Nov 201211:00	–	cvelist
Tenable Nessus	FreeBSD : inn -- plaintext command injection into encrypted channel (a7975581-ee26-11e1-8bd8-0022156e8794)	27 Aug 201200:00	–	nessus
Tenable Nessus	GLSA-201401-24 : INN: Man-in-the-middle attack	22 Jan 201400:00	–	nessus
Tenable Nessus	Mandriva Linux Security Advisory : inn (MDVSA-2012:156)	3 Oct 201200:00	–	nessus
Tenable Nessus	NNTP Service STARTTLS Plaintext Command Injection	9 May 201100:00	–	nessus
Tenable Nessus	openSUSE Security Update : inn (openSUSE-SU-2012:1171-1)	13 Jun 201400:00	–	nessus
Tenable Nessus	SuSE 11.2 Security Update : inn (SAT Patch Number 6774)	25 Jan 201300:00	–	nessus
Tenable Nessus	SuSE 10 Security Update : inn (ZYPP Patch Number 8276)	12 Sep 201200:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	11	all	inn2	2.5.3-1	inn2_2.5.3-1_all.deb
Debian	12	all	inn2	2.5.3-1	inn2_2.5.3-1_all.deb
Debian	13	all	inn2	2.5.3-1	inn2_2.5.3-1_all.deb
Debian	14	all	inn2	2.5.3-1	inn2_2.5.3-1_all.deb
Debian	999	all	inn2	2.5.3-1	inn2_2.5.3-1_all.deb

11 Nov 2012 11:00Current

9.7High risk

Vulners AI Score9.7

CVSS 26.8

EPSS0.03233