CVE

Id
49418  
CVE No.
CVE-2011-1506  
Status
Candidate  
Description
The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411. NOTE: some of these details are obtained from third party information.  
Phase
Assigned (20110322)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
536411 49418 CVE-2011-1506 CONFIRM:http://www.kb.cert.org/vuls/id/MAPG-8D9M4P  View
536412 49418 CVE-2011-1506 CERT-VN:VU#555316  View
536413 49418 CVE-2011-1506 URL:http://www.kb.cert.org/vuls/id/555316  View
536414 49418 CVE-2011-1506 BID:46767  View
536415 49418 CVE-2011-1506 URL:http://www.securityfocus.com/bid/46767  View
536416 49418 CVE-2011-1506 SECUNIA:43678  View
536417 49418 CVE-2011-1506 URL:http://secunia.com/advisories/43678  View
536418 49418 CVE-2011-1506 VUPEN:ADV-2011-0610  View
536419 49418 CVE-2011-1506 URL:http://www.vupen.com/english/advisories/2011/0610  View
536420 49418 CVE-2011-1506 XF:multiple-starttls-command-execution(65932)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
31771 JVNDB-2011-002011 Oracle Sun Products の Oracle GlassFish Server コンポーネントにおける脆弱性 Oracle Sun Products の Oracle GlassFish Server コンポーネントには、機密性および完全性に影響のある脆弱性が存在します。 CVE-2011-1511 49418 6.4 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-002011.html  View