NVD

Id
8802  
Name
CVE-2011-1926  
Description
The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.  
Reject
 
CVSS Version
2  
CVSS Score
5.1  
Severity
Medium  
CVSS Base Score
5.1  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2011-05-23  
Modified Date
2011-09-06  
Seq
2011-1926  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
50716 8802 CVE-2011-1926 http://bugzilla.cyrusimap.org/show_bug.cgi?id=3423  View
50717 8802 CVE-2011-1926 http://bugzilla.cyrusimap.org/show_bug.cgi?id=3424  View
50718 8802 CVE-2011-1926 http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162  View
50719 8802 CVE-2011-1926 FEDORA-2011-7217  View
50720 8802 CVE-2011-1926 FEDORA-2011-7193  View
50721 8802 CVE-2011-1926 [oss-security] 20110517 Re: CVE Request -- Cyrus-IMAP STARTTLS issue -- [was: Re: pure-ftpd STARTTLS command injection / new CVE?]  View
50722 8802 CVE-2011-1926 [oss-security] 20110517 CVE Request -- Cyrus-IMAP STARTTLS issue -- [was: Re: pure-ftpd STARTTLS command injection / new CVE?]  View
50723 8802 CVE-2011-1926 http://www.cyrusimap.org/docs/cyrus-imapd/2.4.7/changes.php  View
50724 8802 CVE-2011-1926 DSA-2242  View
50725 8802 CVE-2011-1926 DSA-2258  View
50726 8802 CVE-2011-1926 VU#555316  View
50727 8802 CVE-2011-1926 MDVSA-2011:100  View
50728 8802 CVE-2011-1926 RHSA-2011:0859  View
50729 8802 CVE-2011-1926 1025625  View
50730 8802 CVE-2011-1926 cyrus-starttls-command-exec(67867)  View
50731 8802 CVE-2011-1926 https://bugzilla.redhat.com/show_bug.cgi?id=705288  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
31484 JVNDB-2011-001724 Cyrus IMAP Server の STARTTLS 実装における暗号化セッションにコマンドを挿入される脆弱性 Cyrus IMAP Server の STARTTLS 実装は、I/O バッファリングを適切に制限しないため、暗号化セッションにコマンドを挿入される脆弱性が存在します。 CVE-2011-1926 49833 CVE-2011-1926 8802 5.1 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-001724.html 2011-05-23 2011-08-01 View