Lucene search
HistoryMar 22, 2011 - 5:55 p.m.
CVE-2011-1506
cve-2011-1506
kerio connect
mailserver
starttls
plaintext command injection
man-in-the-middle
nvd
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
6.7 Medium
AI Score
Confidence
Low
0.011 Low
EPSS
Percentile
84.8%
The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a “plaintext command injection” attack, a similar issue to CVE-2011-0411. NOTE: some of these details are obtained from third party information.
Affected configurations
Node
kerioconnectMatch7.1.4
Node
keriokerio_mailserverMatch5.0
ORkeriokerio_mailserverMatch5.1
ORkeriokerio_mailserverMatch5.1.1
ORkeriokerio_mailserverMatch5.6.3
ORkeriokerio_mailserverMatch5.6.4
ORkeriokerio_mailserverMatch5.6.5
ORkeriokerio_mailserverMatch5.7.0
ORkeriokerio_mailserverMatch5.7.1
ORkeriokerio_mailserverMatch5.7.2
ORkeriokerio_mailserverMatch5.7.3
ORkeriokerio_mailserverMatch5.7.4
ORkeriokerio_mailserverMatch5.7.5
ORkeriokerio_mailserverMatch5.7.6
ORkeriokerio_mailserverMatch5.7.7
ORkeriokerio_mailserverMatch5.7.8
ORkeriokerio_mailserverMatch5.7.9
ORkeriokerio_mailserverMatch5.7.10
ORkeriokerio_mailserverMatch6.0
ORkeriokerio_mailserverMatch6.0.0
ORkeriokerio_mailserverMatch6.0.1
ORkeriokerio_mailserverMatch6.0.2
ORkeriokerio_mailserverMatch6.0.3
ORkeriokerio_mailserverMatch6.0.4
ORkeriokerio_mailserverMatch6.0.5
ORkeriokerio_mailserverMatch6.0.6
ORkeriokerio_mailserverMatch6.0.7
ORkeriokerio_mailserverMatch6.0.8
ORkeriokerio_mailserverMatch6.0.9
ORkeriokerio_mailserverMatch6.0.10
ORkeriokerio_mailserverMatch6.1.1
ORkeriokerio_mailserverMatch6.1.2
ORkeriokerio_mailserverMatch6.1.3
ORkeriokerio_mailserverMatch6.1.3_patch_1
ORkeriokerio_mailserverMatch6.1.4
ORkeriokerio_mailserverMatch6.2.0
ORkeriokerio_mailserverMatch6.2.1
ORkeriokerio_mailserverMatch6.2.2
ORkeriokerio_mailserverMatch6.3.0
ORkeriokerio_mailserverMatch6.3.1
ORkeriokerio_mailserverMatch6.3.1_p1
ORkeriokerio_mailserverMatch6.3.1_p2
ORkeriokerio_mailserverMatch6.4.0
ORkeriokerio_mailserverMatch6.4.1
ORkeriokerio_mailserverMatch6.4.2
ORkeriokerio_mailserverMatch6.5.0
ORkeriokerio_mailserverMatch6.5.0patch_1
ORkeriokerio_mailserverMatch6.5.1
ORkeriokerio_mailserverMatch6.5.2
ORkeriokerio_mailserverMatch6.6.0
ORkeriokerio_mailserverMatch6.6.0patch_1
ORkeriokerio_mailserverMatch6.6.1
ORkeriokerio_mailserverMatch6.6.2
ORkeriokerio_mailserverMatch6.7.0
ORkeriokerio_mailserverMatch6.7.1
ORkeriokerio_mailserverMatch6.7.2
ORkeriokerio_mailserverMatch6.7.3
| CPE | Name | Operator | Version |
|---|---|---|---|
| kerio:connect | kerio connect | eq | 7.1.4 |
Related
prion
prion
Command injection
2011-03-22 17:55:00
Command injection
2011-03-16 22:55:00
Command injection
2011-03-16 22:55:00
nvd
nvd
cvelist
cvelist
openvas
openvas
Kerio Products 'STARTTLS' Plaintext Command Injection Vulnerability
2011-03-25 00:00:00
Kerio Products 'STARTTLS' Plaintext Command Injection Vulnerability
2011-03-25 00:00:00
nessus
nessus
SMTP Service STARTTLS Plaintext Command Injection
2011-03-10 00:00:00
Mandriva Linux Security Advisory : pure-ftpd (MDVSA-2011:046)
2011-03-18 00:00:00
Scientific Linux Security Update : postfix on SL6.x i386/x86_64
2012-08-01 00:00:00
ubuntucve
ubuntucve
cve
cve
securityvulns
securityvulns
Plaintext injection in STARTTLS (multiple implementations)
2011-03-10 00:00:00
[SECURITY] [DSA 2346-1] proftpd-dfsg security update
2011-11-21 00:00:00
[ MDVSA-2012:156 ] inn
2012-10-04 00:00:00
oraclelinux
oraclelinux
postfix security update
2011-04-06 00:00:00
postfix security update
2011-04-06 00:00:00
redhat
redhat
(RHSA-2011:0423) Moderate: postfix security update
2011-04-06 00:00:00
(RHSA-2011:0422) Moderate: postfix security update
2011-04-06 00:00:00
veracode
veracode
Command Injection
2020-04-10 00:54:06
fedora
fedora
[SECURITY] Fedora 14 Update: pure-ftpd-1.0.30-1.fc14
2011-03-31 16:59:13
[SECURITY] Fedora 13 Update: postfix-2.7.3-1.fc13
2011-03-23 22:59:26
[SECURITY] Fedora 14 Update: postfix-2.7.3-1.fc14
2011-03-23 22:59:08
debiancve
debiancve
freebsd
freebsd
postfix -- plaintext command injection with SMTP over TLS
2011-03-07 00:00:00
inn -- plaintext command injection into encrypted channel
2012-08-14 00:00:00
pureftpd -- multiple vulnerabilities
2011-04-01 00:00:00
hackerone
hackerone
PortSwigger Web Security: SMTP interaction theft via MITM
2020-08-07 11:29:14
osv
osv
proftpd-dfsg - several
2011-11-16 00:00:00
proftpd-dfsg - several
2011-11-16 00:00:00
postfix - several
2011-05-10 00:00:00
ubuntu
ubuntu
Postfix vulnerabilities
2011-04-18 00:00:00
checkpoint_advisories
checkpoint_advisories
centos
centos
postfix security update
2011-04-08 12:13:18
debian
debian
[SECURITY] [DSA 2346-1] proftpd-dfsg security update
2011-11-15 20:39:09
[SECURITY] [DSA 2233-1] postfix security update
2011-05-10 17:57:47
gentoo
gentoo
Postfix: Multiple vulnerabilities
2012-06-25 00:00:00
cert
cert
STARTTLS plaintext command injection vulnerability
2011-03-07 00:00:00
kitploit
kitploit
Vision2 - Nmap's XML result parse and NVD's CPE correlation to search CVE
2017-09-08 13:30:00
oracle
oracle
cpuapr2011
2011-04-19 00:00:00
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
6.7 Medium
AI Score
Confidence
Low
0.011 Low
EPSS
Percentile
84.8%
Related for CVE-2011-1506