oss-sec mailing list archives
CVE Request for spamdyke "STARTTLS" Plaintext
From: Agostino Sarubbo <ago () gentoo org>
Date: Sun, 15 Jan 2012 15:48:17 +0100
In reference of: http://www.openwall.com/lists/oss-security/2012/01/07/1 : According to secunia security advisory ( https://secunia.com/advisories/47435 ) : Description: A vulnerability has been reported in spamdyke, which can be exploited by malicious people to manipulate certain data. The vulnerability is caused due to the TLS implementation not properly clearing transport layer buffers when upgrading from plaintext to ciphertext after receiving the "STARTTLS" command. This can be exploited to insert arbitrary plaintext data (e.g. SMTP commands) during the plaintext phase, which will then be executed after upgrading to the TLS ciphertext phase. The vulnerability is reported in versions prior to 4.2.1. Solution: Update to version 4.2.1. And from upstream changelog ( http://www.spamdyke.org/documentation/Changelog.txt ): Changed smtp_filter() and middleman() to discard any buffered input after TLS is started. This prevents the injection of commands into a secure session by sending extra input in the same packet as the "STARTTLS" command. Not really a security problem but good practice anyway. Thanks to Eric Shubert for reporting this one. Sorry Kurt, but atm, I have not found the commit code. -- Agostino Sarubbo ago -at- gentoo.org Gentoo/AMD64 Arch Security Liaison GPG: 0x7CD2DC5D
Attachment:
signature.asc
Description: This is a digitally signed message part.
Current thread:
- CVE Request for spamdyke "STARTTLS" Plaintext Agostino Sarubbo (Jan 15)
- Re: CVE Request for spamdyke "STARTTLS" Plaintext Kurt Seifried (Jan 19)