CVE-2011-1431

NameCVE-2011-1431
DescriptionThe STARTTLS implementation in qmail-smtpd.c in qmail-smtpd in the netqmail-1.06-tls patch for netqmail 1.06 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs652378

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
netqmailsource(unstable)(not affected)
qmailsource(unstable)(unfixed)unimportant652378

Notes

The TLS patch is shipped in the source package, but it's not applied
- netqmail <not-affected> (Doesn't include the TLS patch)

Search for package or bug name: Reporting problems