mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2025-01-08 06:48:28 +00:00
Code Issues Releases Activity

VuXML: document INN plaintext command injection vulnerability

Browse Source
This commit is contained in:
Eygene Ryabinkin 2012-08-24 20:13:53 +00:00
parent 34a636ac73
commit 4a6a3e8277
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=303099
1 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
security/vuxml/vuln.xml
View File

@ -51,6 +51,39 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="a7975581-ee26-11e1-8bd8-0022156e8794">
<topic>inn -- plaintext command injection into encrypted channel</topic>
<affects>
<package>
<name>inn</name>
<range><lt>2.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>INN developers report:</p>
<blockquote cite="https://www.isc.org/software/inn/2.5.3article">
<p>Fixed a possible plaintext command injection during the
negotiation of a TLS layer. The vulnerability detailed
in CVE-2011-0411 affects the STARTTLS and AUTHINFO SASL
commands. nnrpd now resets its read buffer upon
a successful negotiation of a TLS layer. It prevents
malicious commands, sent unencrypted, from being executed
in the new encrypted state of the session.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3523</cvename>
<cvename>CVE-2011-0411</cvename>
<url>https://www.isc.org/software/inn/2.5.3article</url>
</references>
<dates>
<discovery>2012-08-14</discovery>
<entry>2012-08-25</entry>
</dates>
</vuln>
<vuln vid="4d1d2f6d-ec94-11e1-8bd8-0022156e8794">
<topic>jabberd -- domain spoofing in server dialback protocol</topic>
<affects>