6.8

CVE-2011-1430

The STARTTLS implementation in the server in Ipswitch IMail 11.03 and earlier does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ipswitch ≫ Imail Version <= 11.03
Ipswitch ≫ Imail Version5.0
Ipswitch ≫ Imail Version5.0.5
Ipswitch ≫ Imail Version5.0.6
Ipswitch ≫ Imail Version5.0.7
Ipswitch ≫ Imail Version5.0.8
Ipswitch ≫ Imail Version6.00
Ipswitch ≫ Imail Version6.0
Ipswitch ≫ Imail Version6.0.1
Ipswitch ≫ Imail Version6.0.2
Ipswitch ≫ Imail Version6.0.3
Ipswitch ≫ Imail Version6.0.4
Ipswitch ≫ Imail Version6.0.5
Ipswitch ≫ Imail Version6.0.6
Ipswitch ≫ Imail Version6.1
Ipswitch ≫ Imail Version6.2
Ipswitch ≫ Imail Version6.3
Ipswitch ≫ Imail Version6.4
Ipswitch ≫ Imail Version6.06
Ipswitch ≫ Imail Version7.0.1
Ipswitch ≫ Imail Version7.0.2
Ipswitch ≫ Imail Version7.0.3
Ipswitch ≫ Imail Version7.0.4
Ipswitch ≫ Imail Version7.0.5
Ipswitch ≫ Imail Version7.0.6
Ipswitch ≫ Imail Version7.0.7
Ipswitch ≫ Imail Version7.1
Ipswitch ≫ Imail Version7.12
Ipswitch ≫ Imail Version8.0.3
Ipswitch ≫ Imail Version8.0.5
Ipswitch ≫ Imail Version8.1
Ipswitch ≫ Imail Version8.01
Ipswitch ≫ Imail Version8.11
Ipswitch ≫ Imail Version8.12
Ipswitch ≫ Imail Version8.13
Ipswitch ≫ Imail Version8.22
Ipswitch ≫ Imail Version10
Ipswitch ≫ Imail Version10.01
Ipswitch ≫ Imail Version10.02
Ipswitch ≫ Imail Version11
Ipswitch ≫ Imail Version11.01
Ipswitch ≫ Imail Version11.02
Ipswitch ≫ Imail Version2006
Ipswitch ≫ Imail Version2006.1
Ipswitch ≫ Imail Version2006.2
Ipswitch ≫ Imail Versionserver_8.2_hotfix_2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.21% 0.865
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.kb.cert.org/vuls/id/555316
US Government Resource
http://www.securityfocus.com/bid/46767
https://exchange.xforce.ibmcloud.com/vulnerabilities/65932
http://secunia.com/advisories/43676
Vendor Advisory
http://www.kb.cert.org/vuls/id/MAPG-8DBRD4
US Government Resource
http://www.osvdb.org/71020
http://www.vupen.com/english/advisories/2011/0609
Vendor Advisory