Mandriva Linux Security Advisory : inn (MDVSA-2012:156)

A security issue was identified and fixed in ISC INN : The STARTTLS implementation in INN's NNTP server for readers, nnrpd, before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command tha...

Mandriva Update for inn MDVSA-2012:156 (inn)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Mandriva Update for inn MDVSA-2012:156 (inn)

Check for the Version of inn OpenVAS Vulnerability Test Mandriva Update for inn MDVSA-2012:156 inn Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms ...

SuSE 10 Security Update : inn (ZYPP Patch Number 8276)

A STARTTLS injection issue has been fixed in inn. CVE-2012-3523 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid62061;...

Slackware: Security Advisory (SSA:2011-171-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

inn -- plaintext command injection into encrypted channel

INN developers report: Fixed a possible plaintext command injection during the negotiation of a TLS layer. The vulnerability detailed in CVE-2011-0411 affects the STARTTLS and AUTHINFO SASL commands. nnrpd now resets its read buffer upon a successful negotiation of a TLS layer. It prevents...

Network UPS Tools Service STARTTLS Command Support

The remote Network UPS Tools service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel. Since Network UPS Tools provides no configuration setting for the server to require authentication to occur after the 'STARTTLS' command, it is...

Debian Security Advisory DSA 2346-1 (proftpd-dfsg)

The remote host is missing an update to proftpd-dfsg announced via advisory DSA 2346-1. OpenVAS Vulnerability Test $Id: deb23461.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2346-1 proftpd-dfsg Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft In...

FreeBSD : spamdyke -- STARTTLS Plaintext Injection Vulnerability (a47af810-3a17-11e1-a1be-00e0815b8da8)

Secunia reports : The vulnerability is caused due to the TLS implementation not properly clearing transport layer buffers when upgrading from plaintext to ciphertext after receiving the 'STARTTLS' command. This can be exploited to insert arbitrary plaintext data e.g. SMTP commands during the...

spamdyke -- STARTTLS Plaintext Injection Vulnerability

Secunia reports: The vulnerability is caused due to the TLS implementation not properly clearing transport layer buffers when upgrading from plaintext to ciphertext after receiving the "STARTTLS" command. This can be exploited to insert arbitrary plaintext data e.g. SMTP commands during the...

SuSE 10 Security Update : Postfix (ZYPP Patch Number 7403)

The following bug has been fixed : - Postfix did not clear the receive buffer after the STARTTLS command. A man-in-the middle could therefore inject commands in the unencrypted stream that get interpreted in the encrypted phase after STARTTLS. CVE-2011-0411 %NASLMINLEVEL 70300 C Tenable Network...

SuSE 10 Security Update : cyrus-imapd (ZYPP Patch Number 7583)

Cyrus-imapd recognized commands before switching to an encrypted channel via STARTTLS. Attackers could potentially exploit that to inject plain text commands. CVE-2011-1926 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

DSA-2346-2 proftpd-dfsg - several

Bulletin has no description...

[SECURITY] [DSA 2346-1] proftpd-dfsg security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2346-1 [email protected] http://www.debian.org/security/ Florian Weimer November 15, 2011 http://www.debian.org/security/faq -...

DSA-2346-1 proftpd-dfsg - several

Bulletin has no description...

Debian Security Advisory DSA 2258-1 (kolab-cyrus-imapd)

The remote host is missing an update to kolab-cyrus-imapd announced via advisory DSA 2258-1. OpenVAS Vulnerability Test $Id: deb22581.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2258-1 kolab-cyrus-imapd Authors: Thomas Reinke Copyright: Copyright c 2011...

Debian Security Advisory DSA 2242-1 (cyrus-imapd-2.2)

The remote host is missing an update to cyrus-imapd-2.2 announced via advisory DSA 2242-1. OpenVAS Vulnerability Test $Id: deb22421.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2242-1 cyrus-imapd-2.2 Authors: Thomas Reinke Copyright: Copyright c 2011...

FreeBSD Ports: pure-ftpd

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Debian: Security Advisory (DSA-2242-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 2233-1 (postfix)

The remote host is missing an update to postfix announced via advisory DSA 2233-1. OpenVAS Vulnerability Test $Id: deb22331.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2233-1 postfix Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...