From 4a6a3e8277f4dcdc6a5a4991aca8ecc94f6d1514 Mon Sep 17 00:00:00 2001 From: Eygene Ryabinkin Date: Fri, 24 Aug 2012 20:13:53 +0000 Subject: [PATCH] VuXML: document INN plaintext command injection vulnerability --- security/vuxml/vuln.xml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 1fae0e601b2a..d92a0da31de4 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -51,6 +51,39 @@ Note: Please add new entries to the beginning of this file. --> + + inn -- plaintext command injection into encrypted channel + + + inn + 2.5.3 + + + + +

INN developers report:

+
+

Fixed a possible plaintext command injection during the + negotiation of a TLS layer. The vulnerability detailed + in CVE-2011-0411 affects the STARTTLS and AUTHINFO SASL + commands. nnrpd now resets its read buffer upon + a successful negotiation of a TLS layer. It prevents + malicious commands, sent unencrypted, from being executed + in the new encrypted state of the session.

+
+ + + + CVE-2012-3523 + CVE-2011-0411 + https://www.isc.org/software/inn/2.5.3article + + + 2012-08-14 + 2012-08-25 + + + jabberd -- domain spoofing in server dialback protocol