Lucene search
Ubuntu.comUB:CVE-2014-3556HistoryDec 29, 2014 - 12:00 a.m.
CVE-2014-3556
2014-12-2900:00:00
ubuntu.com
ubuntu.com
11
0.002 Low
EPSS
Percentile
52.9%
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP
proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not
properly restrict I/O buffering, which allows man-in-the-middle attackers
to insert commands into encrypted SMTP sessions by sending a cleartext
command that is processed after TLS is in place, related to a “plaintext
command injection” attack, a similar issue to CVE-2011-0411.
Bugs
Notes
| Author | Note |
|---|---|
| mdeslaur | per Debian, only affects 1.5.6 to 1.7.3 |
Related
cve
cve
prion
prion
Command injection
2014-12-29 20:59:00
Command injection
2011-03-16 22:55:00
Command injection
2011-03-16 22:55:00
checkpoint_advisories
checkpoint_advisories
cvelist
cvelist
debiancve
debiancve
nessus
nessus
nginx < 1.6.1 / 1.7.4 SMTP STARTTLS Command Injection
2014-08-19 00:00:00
FreeBSD : nginx -- inject commands into SSL session vulnerability (ad747a01-1fee-11e4-8ff1-f0def16c5c1b)
2014-08-10 00:00:00
openSUSE Security Update : postfix (openSUSE-SU-2011:0389-1)
2014-06-13 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 9 package nginx version 1.6.1-alt1
2014-08-06 00:00:00
nginx
nginx
STARTTLS command injection
2014-12-29 20:59:00
openvas
openvas
nginx Information Disclosure Vulnerability (CVE-2014-3556)
2020-11-05 00:00:00
Fedora Update for postfix FEDORA-2011-3355
2011-03-25 00:00:00
RedHat Update for postfix RHSA-2011:0423-01
2012-06-06 00:00:00
freebsd
freebsd
nginx -- inject commands into SSL session vulnerability
2014-08-05 00:00:00
postfix -- plaintext command injection with SMTP over TLS
2011-03-07 00:00:00
inn -- plaintext command injection into encrypted channel
2012-08-14 00:00:00
fedora
fedora
[SECURITY] Fedora 14 Update: pure-ftpd-1.0.30-1.fc14
2011-03-31 16:59:13
[SECURITY] Fedora 14 Update: postfix-2.7.3-1.fc14
2011-03-23 22:59:08
[SECURITY] Fedora 13 Update: postfix-2.7.3-1.fc13
2011-03-23 22:59:26
oraclelinux
oraclelinux
postfix security update
2011-04-06 00:00:00
postfix security update
2011-04-06 00:00:00
redhat
redhat
(RHSA-2011:0423) Moderate: postfix security update
2011-04-06 00:00:00
(RHSA-2011:0422) Moderate: postfix security update
2011-04-06 00:00:00
veracode
veracode
Command Injection
2020-04-10 00:54:06
securityvulns
securityvulns
Plaintext injection in STARTTLS (multiple implementations)
2011-03-10 00:00:00
[SECURITY] [DSA 2346-1] proftpd-dfsg security update
2011-11-21 00:00:00
[ MDVSA-2011:100 ] cyrus-imapd
2011-05-25 00:00:00
ubuntucve
ubuntucve
hackerone
hackerone
PortSwigger Web Security: SMTP interaction theft via MITM
2020-08-07 11:29:14
debian
debian
[SECURITY] [DSA 2346-1] proftpd-dfsg security update
2011-11-15 20:39:52
[SECURITY] [DSA 2233-1] postfix security update
2011-05-10 17:58:13
osv
osv
proftpd-dfsg - several
2011-11-16 00:00:00
proftpd-dfsg - several
2011-11-16 00:00:00
postfix - several
2011-05-10 00:00:00
centos
centos
postfix security update
2011-04-08 12:13:18
ubuntu
ubuntu
Postfix vulnerabilities
2011-04-18 00:00:00
gentoo
gentoo
Postfix: Multiple vulnerabilities
2012-06-25 00:00:00
cert
cert
STARTTLS plaintext command injection vulnerability
2011-03-07 00:00:00
kitploit
kitploit
Vision2 - Nmap's XML result parse and NVD's CPE correlation to search CVE
2017-09-08 13:30:00
oracle
oracle
cpuapr2011
2011-04-19 00:00:00