STARTTLS plaintext command injection vulnerability

Overview Some STARTTLS implementations could allow a remote attacker to inject commands during the plaintext phase of the protocol. Description STARTTLS is an extension to plaintext communication protocols that offers a way to upgrade a plaintext connection to an encrypted TLS or SSL connection...

Memory corruption

The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2000 SP3, does not properly allocate memory for SMTP command replies, which allows remote attackers to read fragments of e-mail messages by sending a series of...

HP-UX Update for sendmail with STARTTLS Enabled HPSBUX02508

Check for the Version of sendmail with STARTTLS Enabled OpenVAS Vulnerability Test HP-UX Update for sendmail with STARTTLS Enabled HPSBUX02508 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...

HP-UX Update for sendmail with STARTTLS Enabled HPSBUX02508

Check for the Version of sendmail with STARTTLS Enabled OpenVAS Vulnerability Test HP-UX Update for sendmail with STARTTLS Enabled HPSBUX02508 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...

LDAP Service STARTTLS Command Support

The remote LDAP service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42329; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate",...

ACAP Service STARTTLS Command Support

The remote ACAP service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42084; scriptversion"$Revision: 1.9 $"; scriptcvsdate"$Date: 2017/06/15 21:59:54 $";...

IMAP Service STARTTLS Command Support

The remote IMAP service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42085; scriptversion"1.9"; scriptsetattributeattribute:"pluginmodificationdate",...

POP3 Service STLS Command Support

The remote POP3 service supports the use of the 'STLS' command to switch from a cleartext to an encrypted communications channel. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42087; scriptversion"1.13"; scriptsetattributeattribute:"pluginmodificationdate",...

NNTP Service STARTTLS Command Support

The remote NNTP service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42086; scriptversion"1.9"; scriptnameenglish:"NNTP Service STARTTLS Command Support";...

XMPP Service STARTTLS Command Support

The remote XMPP eXtensible Messaging and Presence Protocol service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42089; scriptversion"$Revision: 1.8 $";...

SMTP Service STARTTLS Command Support

The remote SMTP service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42088; scriptversion"1.12"; scriptcvsdate"Date: 2019/03/20 12:54:43";...

fetchmail -- TLS enforcement problem/MITM attack/password exposure

Matthias Andree reports: Fetchmail has had several longstanding password disclosure vulnerabilities. sslcertck/sslfingerprint options should have implied "sslproto tls1" in order to enforce TLS negotiation, but did not. Even with "sslproto tls1" in the config, fetches would go ahead in plain text...

qmail starttls patch does not seed the random number generator

openssl-0.9.6b does not allow ssl/tls connections when the random number has not been seeded. This is a good idea, and it exposes that the starttls patch for qmail does not seed the random number generator. Here is a small patch that fixes the problem in qmail-remote for systems that support...