Lucene search

K

[email protected]NVD:CVE-2011-1430

HistoryMar 16, 2011 - 10:55 p.m.

CVE-2011-1430

2011-03-1622:55:04

CWE-20

[email protected]

web.nvd.nist.gov

6

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

6.6

Confidence

Low

EPSS

0.011

Percentile

84.8%

The STARTTLS implementation in the server in Ipswitch IMail 11.03 and earlier does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a “plaintext command injection” attack, a similar issue to CVE-2011-0411.

Affected configurations

Nvd

Node

ipswitchimail

OR

ipswitchimailRange≤11.03

OR

ipswitchimailMatch5.0

OR

ipswitchimailMatch5.0.5

OR

ipswitchimailMatch5.0.6

OR

ipswitchimailMatch5.0.7

OR

ipswitchimailMatch5.0.8

OR

ipswitchimailMatch6.00

OR

ipswitchimailMatch6.0

OR

ipswitchimailMatch6.0.1

OR

ipswitchimailMatch6.0.2

OR

ipswitchimailMatch6.0.3

OR

ipswitchimailMatch6.0.4

OR

ipswitchimailMatch6.0.5

OR

ipswitchimailMatch6.0.6

OR

ipswitchimailMatch6.1

OR

ipswitchimailMatch6.2

OR

ipswitchimailMatch6.3

OR

ipswitchimailMatch6.4

OR

ipswitchimailMatch6.06

OR

ipswitchimailMatch7.0.1

OR

ipswitchimailMatch7.0.2

OR

ipswitchimailMatch7.0.3

OR

ipswitchimailMatch7.0.4

OR

ipswitchimailMatch7.0.5

OR

ipswitchimailMatch7.0.6

OR

ipswitchimailMatch7.0.7

OR

ipswitchimailMatch7.1

OR

ipswitchimailMatch7.12

OR

ipswitchimailMatch8.0.3

OR

ipswitchimailMatch8.0.5

OR

ipswitchimailMatch8.1

OR

ipswitchimailMatch8.01

OR

ipswitchimailMatch8.11

OR

ipswitchimailMatch8.12

OR

ipswitchimailMatch8.13

OR

ipswitchimailMatch8.22

OR

ipswitchimailMatch10

OR

ipswitchimailMatch10.01

OR

ipswitchimailMatch10.02

OR

ipswitchimailMatch11

OR

ipswitchimailMatch11.01

OR

ipswitchimailMatch11.02

OR

ipswitchimailMatch2006

OR

ipswitchimailMatch2006.1

OR

ipswitchimailMatch2006.2

OR

ipswitchimailMatchserver_8.2_hotfix_2

References

secunia.com/advisories/43676

www.kb.cert.org/vuls/id/555316

www.kb.cert.org/vuls/id/MAPG-8DBRD4

www.osvdb.org/71020

www.securityfocus.com/bid/46767

www.vupen.com/english/advisories/2011/0609

exchange.xforce.ibmcloud.com/vulnerabilities/65932

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

6.6

Confidence

Low

EPSS

0.011

Percentile

84.8%

Related for NVD:CVE-2011-1430