CVE-2011-1926: Command Injection
It was found, that Cyrus IMAP recognized IMAP, LMTP, NNTP and POP3 protocol commands during plaintex to TLS session switch (by TLS protocol initialization). A remote attacker could use this flaw to insert plaintext, protocol relevant, commands into TLS protocol initialization messages, leading to execution of these commands during the ciphertext protocol phase, potentially allowing the attacker to steal the victim's mail or authentication credentials.
References: [1] http://www.kb.cert.org/vuls/id/555316 [2] http://bugzilla.cyrusimap.org/showbug.cgi?id=3423
Relevant upstream patch: [3] http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162
Other sources
The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1926?
CVE-2011-1926 has a moderate severity rating due to its potential to allow remote attackers to execute arbitrary commands during a TLS session.
How do I fix CVE-2011-1926?
To fix CVE-2011-1926, update Cyrus IMAP Server to version 2.4.6 or later, which addresses this vulnerability.
What versions of Cyrus IMAP Server are affected by CVE-2011-1926?
CVE-2011-1926 affects Cyrus IMAP Server versions 2.0.17 through 2.4.5.
Can CVE-2011-1926 be exploited remotely?
Yes, CVE-2011-1926 can be exploited remotely by attackers inserting malicious commands during the TLS handshake.
What are the potential consequences of CVE-2011-1926?
The consequences of CVE-2011-1926 may include unauthorized execution of commands resulting in data leakage or additional system compromise.