SMTP: Multiple Products STARTTLS Plaintext Command Injection
This signature detects attempts to exploit a known vulnerability against several mail transfer agents (MTA's). A successful attack can lead to arbitrary command injection.
Extended Description
Multiple vendors' implementations of STARTTLS are prone to a vulnerability that lets attackers inject arbitrary commands. An attacker can exploit this issue to execute arbitrary commands in the context of the user running the application. Successful exploits can allow attackers to obtain email usernames and passwords. The following vendors are affected: Ipswitch Kerio Postfix Qmail-TLS Oracle (note that the affected application is unknown) SCO Group spamdyke ISC
Affected Products
Ietf starttls,Wietse_venema postfix
Short Name
SMTP:COMMAND:STARTTLS-CMD
Severity
Major
Recommended
False
Recommended Action
None
Category
SMTP
Keywords
CVE-2011-0411 CVE-2011-1926 CVE-2014-3556 Command Injection Multiple Plaintext Products STARTTLS bid:46767
Release Date
06/22/2011
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3590
False Positive
Unknown
Vendors
Sun
Cyrus
Isc
Gentoo
Avaya
Watchguard
Pardus
Ubuntu
Debian
Ietf
Kerio
Mandriva
Pure-ftpd
Qmail-smtpd-auth
Spamdyke
Red_hat
Sco
Suse
Apple
Ipswitch
Wietse_venema
Kolab
CVSS Score
6.8
5.1