Ubuntu
inn2 package

  1. Bug #1039881
  2. Comment #1

Comment 1 for bug 1039881

Revision history for this message
In , Jeroen Roovers (jer-gentoo) wrote :

* Fixed a possible plaintext command injection during the negotiation of
    a TLS layer. The vulnerability detailed in CVE-2011-0411 affects the
    STARTTLS and AUTHINFO SASL commands. nnrpd now resets its read buffer
    upon a successful negotiation of a TLS layer. It prevents malicious
    commands, sent unencrypted, from being executed in the new encrypted
    state of the session.