<inn-2.5.3 - plaintext command injection during the negotiation of a TLS layer

[Karma Dorje]

The STARTTLS implementation in INN's NNTP server for readers,
nnrpd, before 2.5.3 does not properly restrict I/O buffering,
which allows man-in-the-middle attackers to insert commands
into encrypted sessions by sending a cleartext command that
is processed after TLS is in place, related to a "plaintext
command injection" attack, a similar issue to CVE-2011-0411.

References:
[1] https://www.isc.org/software/inn/2.5.3article
[2] https://bugs.gentoo.org/show_bug.cgi?id=432002
[3] https://bugzilla.redhat.com/show_bug.cgi?id=850478

Relevant upstream patch
(the 'diff -Nurp inn-2.5.2/nnrpd/misc.c inn-2.5.3/nnrpd/misc.c' part):
[4] ftp://ftp.isc.org/isc/inn/inn-2.5.2-2.5.3.diff.gz

[Jeroen Roovers (jer-gentoo)]

* Fixed a possible plaintext command injection during the negotiation of
    a TLS layer. The vulnerability detailed in CVE-2011-0411 affects the
    STARTTLS and AUTHINFO SASL commands. nnrpd now resets its read buffer
    upon a successful negotiation of a TLS layer. It prevents malicious
    commands, sent unencrypted, from being executed in the new encrypted
    state of the session.

[Jeroen Roovers (jer-gentoo)]

Arch teams, please test and mark stable:
=net-nntp/inn-2.5.3
Stable KEYWORDS : amd64 ppc x86

[J-ago (j-ago)]

amd64 stable

[Jamie Strandboge (jdstrand)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. This is fixed in 2.5.3-1 on 12.10. For the earlier releases, if you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures.

[Phajdan-jr (phajdan-jr)]

x86 stable

[Jeroen Roovers (jer-gentoo)]

ping

[Jeroen Roovers (jer-gentoo)]

ppc64?

[Ranger-z (ranger-z)]

ppc done

[Glsamaker (glsamaker)]

CVE-2012-3523 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3523):
  The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly
  restrict I/O buffering, which allows man-in-the-middle attackers to insert
  commands into encrypted sessions by sending a cleartext command that is
  processed after TLS is in place, related to a "plaintext command injection"
  attack, a similar issue to CVE-2011-0411.

[Ackle (ackle)]

Thanks, everyone.

GLSA vote: yes.

[Craig-gentoo (craig-gentoo)]

Yes, created GLSA request.

[Michael (kensington)]

Nothing else to do for net-news here.

[Glsamaker (glsamaker)]

This issue was resolved and addressed in
 GLSA 201401-24 at http://security.gentoo.org/glsa/glsa-201401-24.xml
by GLSA coordinator Chris Reffett (creffett).