CVE-2011-1431

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

The STARTTLS implementation in qmail-smtpd.c in qmail-smtpd in the netqmail-1.06-tls patch for netqmail 1.06 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published
Mar 16, 2011
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2011

CVE-2011-14326.8The STARTTLS implementation in SCO SCOoffice Server does not properly restrict I/O buffering, which allows man-in-the-middle attackers to inCVE-2011-14335.0The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials inCVE-2011-14346.8Google Chrome before 11.0.696.57 does not ensure thread safety during handling of MIME data, which allows remote attackers to cause a denialCVE-2011-14355.0Google Chrome before 11.0.696.57 does not properly implement the tabs permission for extensions, which allows remote attackers to read localCVE-2011-14365.0Google Chrome before 11.0.696.57 on Linux does not properly interact with the X Window System, which allows remote attackers to cause a deniCVE-2011-14376.8Multiple integer overflows in Google Chrome before 11.0.696.57 allow remote attackers to cause a denial of service or possibly have unspecifCVE-2011-14387.5Google Chrome before 11.0.696.57 allows remote attackers to bypass the Same Origin Policy via vectors involving blobs.CVE-2011-14396.8Google Chrome before 11.0.696.57 on Linux does not properly isolate renderer processes, which has unspecified impact and remote attack vectoCVE-2011-14406.8Use-after-free vulnerability in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspeCVE-2011-14416.8Google Chrome before 11.0.696.57 does not properly perform a cast of an unspecified variable during handling of floating select lists, whichCVE-2011-14426.8Google Chrome before 11.0.696.57 does not properly handle mutation events, which allows remote attackers to cause a denial of service (node CVE-2011-14436.8Google Chrome before 11.0.696.57 does not properly implement layering, which allows remote attackers to cause a denial of service or possibl
CVE-2011-1431: Medium severity, CVSS 6.8 | Vulnix