From owner-svn-ports-all@FreeBSD.ORG Fri Aug 24 20:13:54 2012 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 730C1106566B; Fri, 24 Aug 2012 20:13:54 +0000 (UTC) (envelope-from rea@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 5E19F8FC14; Fri, 24 Aug 2012 20:13:54 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q7OKDsNN098046; Fri, 24 Aug 2012 20:13:54 GMT (envelope-from rea@svn.freebsd.org) Received: (from rea@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q7OKDrrr098044; Fri, 24 Aug 2012 20:13:53 GMT (envelope-from rea@svn.freebsd.org) Message-Id: <201208242013.q7OKDrrr098044@svn.freebsd.org> From: Eygene Ryabinkin Date: Fri, 24 Aug 2012 20:13:53 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r303099 - head/security/vuxml X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Aug 2012 20:13:54 -0000 Author: rea Date: Fri Aug 24 20:13:53 2012 New Revision: 303099 URL: http://svn.freebsd.org/changeset/ports/303099 Log: VuXML: document INN plaintext command injection vulnerability Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Aug 24 19:54:38 2012 (r303098) +++ head/security/vuxml/vuln.xml Fri Aug 24 20:13:53 2012 (r303099) @@ -51,6 +51,39 @@ Note: Please add new entries to the beg --> + + inn -- plaintext command injection into encrypted channel + + + inn + 2.5.3 + + + + +

INN developers report:

+
Fixed a possible plaintext command injection during the + negotiation of a TLS layer. The vulnerability detailed + in CVE-2011-0411 affects the STARTTLS and AUTHINFO SASL + commands. nnrpd now resets its read buffer upon + a successful negotiation of a TLS layer. It prevents + malicious commands, sent unencrypted, from being executed + in the new encrypted state of the session.
+

+ + + + CVE-2012-3523 + CVE-2011-0411 + https://www.isc.org/software/inn/2.5.3article + + + 2012-08-14 + 2012-08-25 + + + jabberd -- domain spoofing in server dialback protocol