Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
gentooGentoo FoundationGLSA-201401-24
HistoryJan 21, 2014 - 12:00 a.m.

INN: Man-in-the-middle attack

2014-01-2100:00:00
Gentoo Foundation
security.gentoo.org
18

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

59.1%

JSON

Background

INN is a news server which can interface with Usenet.

Description

INN’s I/O buffering is not correctly restricted.

Impact

A remote attacker could inject commands into encrypted NNTP sessions.

Workaround

There is no known workaround at this time.

Resolution

All INN users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-nntp/inn-2.5.3"
OSVersionArchitecturePackageVersionFilename
Gentooanyallnet-nntp/inn< 2.5.3UNKNOWN

Related

openvas 6
nessus 7
debiancve 1
prion 1
cve 1
ubuntucve 1
cvelist 1
securityvulns 2
nvd 1
freebsd 1
openvas
openvas
Gentoo Security Advisory GLSA 201401-24
2015-09-29 00:00:00
SUSE: Security Advisory (SUSE-SU-2012:1147-1)
2021-06-09 00:00:00
Mandriva Update for inn MDVSA-2012:156 (inn)
2012-10-03 00:00:00
nessus
nessus
GLSA-201401-24 : INN: Man-in-the-middle attack
2014-01-22 00:00:00
SuSE 11.2 Security Update : inn (SAT Patch Number 6774)
2013-01-25 00:00:00
NNTP Service STARTTLS Plaintext Command Injection
2011-05-09 00:00:00
debiancve
debiancve
CVE-2012-3523
2012-11-11 13:00:46
prion
prion
Command injection
2012-11-11 13:00:00
cve
cve
CVE-2012-3523
2012-11-11 13:00:46
ubuntucve
ubuntucve
CVE-2012-3523
2012-11-11 00:00:00
cvelist
cvelist
CVE-2012-3523
2012-11-11 11:00:00
securityvulns
securityvulns
[ MDVSA-2012:156 ] inn
2012-10-04 00:00:00
STARTTLS vulnerability in different mail applications
2012-10-04 00:00:00
nvd
nvd
CVE-2012-3523
2012-11-11 13:00:46
freebsd
freebsd
inn -- plaintext command injection into encrypted channel
2012-08-14 00:00:00

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

59.1%

JSON
Related for GLSA-201401-24
openvas6nessus7debiancve1prion1cve1ubuntucve1cvelist1securityvulns2nvd1freebsd1