Vulnerability CVE-2011-1432 - CERT Civis.Net

Vulnerability Name:

CVE-2011-1432 (CCN-65932)

Assigned:

2011-03-07

Published:

2011-03-07

Updated:

2017-08-17

Summary:

The STARTTLS implementation in SCO SCOoffice Server does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
Per: http://cwe.mitre.org/data/definitions/77.html

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2011-0411

Source: MITRE
Type: CNA
CVE-2011-1430

Source: MITRE
Type: CNA
CVE-2011-1431

Source: MITRE
Type: CNA
CVE-2011-1432

Source: MITRE
Type: CNA
CVE-2011-1506

Source: MITRE
Type: CNA
CVE-2011-1575

Source: CCN
Type: Kolab Web Site
Announcing the Kolab Server 2.3.2

Source: CCN
Type: RHSA-2011-0422
Moderate: postfix security update

Source: CCN
Type: RHSA-2011-0423
Moderate: postfix security update

Source: CCN
Type: SA43646
Postfix STARTTLS Plaintext Injection Vulnerability

Source: CCN
Type: SA43676
Ipswitch IMail Server STARTTLS Plaintext Injection Vulnerability

Source: CCN
Type: SA43678
Kerio Connect STARTTLS Plaintext Injection Vulnerability

Source: CCN
Type: SA43988
Pure-FTPd STARTTLS Plaintext Injection Vulnerability

Source: CCN
Type: SA44301
Oracle Communications Messaging Server STARTTLS Plaintext Injection Vulnerability

Source: CCN
Type: SA44414
Cyrus IMAP Server STARTTLS Plaintext Injection Vulnerability

Source: CCN
Type: SA44863
Kolab Server Multiple Vulnerabilities

Source: CCN
Type: SA45857
SCOoffice Server "STARTTLS" Plaintext Injection Vulnerability

Source: DEBIAN
Type: DSA-2233
postfix -- several vulnerabilities

Source: CCN
Type: Ipswitch, Inc. Web site
Mail Server, SMTP Server, Email Server - IMail Server

Source: CCN
Type: US-CERT VU#555316
STARTTLS plaintext command injection vulnerability

Source: CERT-VN
Type: US Government Resource
VU#555316

Source: CONFIRM
Type: US Government Resource
http://www.kb.cert.org/vuls/id/MAPG-8D9M6A

Source: CCN
Type: Oracle Critical Patch Update Advisory - April 2011
Oracle Critical Patch Update Advisory - April 2011

Source: CCN
Type: OSVDB ID: 71020
Ipswitch IMail Server STARTTLS Arbitrary Plaintext Command Injection

Source: CCN
Type: OSVDB ID: 71021
Postfix STARTTLS Arbitrary Plaintext Command Injection

Source: CCN
Type: OSVDB ID: 71854
Kerio Connect STARTTLS Arbitrary Plaintext Command Injection

Source: CCN
Type: OSVDB ID: 71855
Pure-FTPd STARTTLS Arbitrary Plaintext Command Injection

Source: CCN
Type: OSVDB ID: 71946
Oracle Sun Java System Messaging Server SMTP Server / IMAP Server / POP Server STARTTLS Arbitrary Plaintext Command Injection

Source: CCN
Type: OSVDB ID: 72186
Cyrus IMAP Server STARTTLS Arbitrary Plaintext Command Injection

Source: CCN
Type: OSVDB ID: 75014
SCO SCOoffice Server STARTTLS I/O Buffering MiTM Plaintext Command Injection

Source: CCN
Type: OSVDB ID: 75256
netqmail qmail-smtpd qmail-smtpd.c STARTTLS I/O Buffering MiTM Plaintext Command Injection

Source: CCN
Type: Postfix Web Site
Plaintext command injection in multiple implementations of STARTTLS (CVE-2011-0411)

Source: BID
Type: UNKNOWN
46767

Source: CCN
Type: BID-46767
Multiple Vendors STARTTLS Implementation Plaintext Arbitrary Command Injection Vulnerability

Source: VUPEN
Type: Vendor Advisory
ADV-2011-0613

Source: CCN
Type: WatchGuard Web site
Release Notes for WatchGuard XCS v9.1 TLS Hotfix

Source: XF
Type: UNKNOWN
multiple-starttls-command-execution(65932)

Source: XF
Type: UNKNOWN
multiple-starttls-command-execution(65932)

Source: SUSE
Type: SUSE-SR:2011:008
SUSE Security Summary Report

Source: SUSE
Type: SUSE-SR:2011:009
SUSE Security Summary Report

Vulnerable Configuration:

Configuration 1:

cpe:/a:sco:scoofficeserver:*:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:postfix:postfix:2.4.8:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.4:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.3:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.2:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.1:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.7:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.6:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.5:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.0:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.9:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.10:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.11:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.12:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.13:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.14:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.4.15:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.5.0:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.5.5:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.5.3:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.5.4:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.5.2:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.5.6:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.5.7:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.5.8:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.5.9:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.5.10:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.5.11:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.6:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.6.0:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.6.1:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.6.2:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.6.3:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.6.4:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.6.5:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.6.6:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.6.7:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.6.8:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.7.0:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.7.1:*:*:*:*:*:*:*

OR cpe:/a:postfix:postfix:2.7.2:*:*:*:*:*:*:*

AND

cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:6:*:server:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:6:*:workstation:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_desktop:6:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_hpc_node:6:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_eus:5.6.z::server:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_long_life:5.6:*:*:*:*:*:*:*

Denotes that component is vulnerable