The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.

- fix starttls command injection issue (CVE-2012-3523),     [bnc#776967]

  - handle /var/run on tmpfs. [bnc#778439]

The remote host is affected by the vulnerability described in GLSA-201401-24 (INN: Man-in-the-middle attack)

    INN&rsquo;s I/O buffering is not correctly restricted.
  Impact :

    A remote attacker could inject commands into encrypted NNTP sessions.
  Workaround :

    There is no known workaround at this time.

A STARTTLS injection issue has been fixed in inn. CVE-2012-3523 was assigned to this issue.

A security issue was identified and fixed in ISC INN :

The STARTTLS implementation in INN's NNTP server for readers, nnrpd, before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a plaintext command injection attack, a similar issue to CVE-2011-0411 (CVE-2012-3523).

The updated packages have been upgraded to inn 2.5.3 which is not vulnerable to this issue.

A STARTTLS injection issue has been fixed in inn. CVE-2012-3523 has been assigned to this issue.

INN developers report :

Fixed a possible plaintext command injection during the negotiation of a TLS layer. The vulnerability detailed in CVE-2011-0411 affects the STARTTLS and AUTHINFO SASL commands. nnrpd now resets its read buffer upon a successful negotiation of a TLS layer. It prevents malicious commands, sent unencrypted, from being executed in the new encrypted state of the session.

The remote news server contains a software flaw in its STARTTLS implementation that could allow a remote, unauthenticated attacker to inject commands during the plaintext protocol phase that will be executed during the ciphertext protocol phase. 

Successful exploitation could allow an attacker access to private newsgroups and reveal a user's credentials.

ID	Name	Product	Family	Severity
74753	openSUSE Security Update : inn (openSUSE-SU-2012:1171-1)	Nessus	SuSE Local Security Checks	medium
72079	GLSA-201401-24 : INN: Man-in-the-middle attack	Nessus	Gentoo Local Security Checks	medium
64159	SuSE 11.2 Security Update : inn (SAT Patch Number 6774)	Nessus	SuSE Local Security Checks	medium
62404	Mandriva Linux Security Advisory : inn (MDVSA-2012:156)	Nessus	Mandriva Local Security Checks	medium
62061	SuSE 10 Security Update : inn (ZYPP Patch Number 8276)	Nessus	SuSE Local Security Checks	medium
61676	FreeBSD : inn -- plaintext command injection into encrypted channel (a7975581-ee26-11e1-8bd8-0022156e8794)	Nessus	FreeBSD Local Security Checks	medium
53848	NNTP Service STARTTLS Plaintext Command Injection	Nessus	Misc.	medium

Detections

Analytics

CVE-2012-3523

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium