Notified:  January 21, 2011 Updated: March 01, 2011

Status

Affected

Vendor Statement

We will work on addressing this vulnerability in an upcoming release of IMail.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Notified:  January 19, 2011 Updated: March 01, 2011

Status

Affected

Vendor Statement

We are going to resolve the issue in the next product version.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Updated:  March 03, 2011

Status

Affected

Vendor Statement

Postfix legacy releases 2.7.3, 2.6.9, 2.5.12 and 2.4.16 are available. These releases contain a fix for CVE-2011-0411 which allows plaintext command injection with SMTP sessions over TLS. This defect was introduced with Postfix version 2.2. Postfix 2.8 and 2.9 are not affected.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• http://www.postfix.org/announcements/postfix-2.7.3.html

Notified:  January 19, 2011 Updated: March 07, 2011

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

Q-Mail has released a patch to address this vulnerability.

Vendor References

• http://inoa.net/qmail-tls/vu555316.patch

Addendum

Note that Qmail-TLS is a third-party extension for the qmail software. Because STARTTLS is not supported by default in either the original qmail distribution or the netqmail distribution, those distributions are not vulnerable to this issue.

Notified:  January 19, 2011 Updated: April 07, 2011

Status

Affected

Vendor Statement

Vulnerable. This issue affects postfix packages in Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this issue as having moderate security impact, a future update will address this flaw. This issue did not affect the versions of the sendmail package as shipped with Red Hat Enterprise Linux 3, 4, 5, or 6, as Sendmail by switching to SMTP over TLS replaces the entire received SMTP commands stream, along with its read/write buffers and read/write functions. This issue did not affect the versions of the exim package as shipped with Red Hat Enterprise Linux 4 and 5, as Exim by switching to SMTP over TLS replaces plaintext read/write functions with TLS read/write functions.

Vendor Information

Red Hat has released updated postfix packages, for: Red Hat Enterprise Linux 4 and 5: https://rhn.redhat.com/errata/RHSA-2011-0422.html https://bugzilla.redhat.com/show_bug.cgi?id=674814#c26 Red Hat Enterprise Linux 6: https://rhn.redhat.com/errata/RHSA-2011-0423.html https://bugzilla.redhat.com/show_bug.cgi?id=674814#c27

Vendor References

• http://www.redhat.com/security/data/cve/CVE-2011-0411.html
• https://rhn.redhat.com/errata/RHSA-2011-0422.html
• https://bugzilla.redhat.com/show_bug.cgi?id=674814#c26
• https://rhn.redhat.com/errata/RHSA-2011-0423.html
• https://bugzilla.redhat.com/show_bug.cgi?id=674814#c27

Notified:  January 19, 2011 Updated: March 01, 2011

Status

Affected

Vendor Statement

The issue is being fixed in affected products and would be announced in a quarterly Oracle Critical Patch update.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Notified:  January 19, 2011 Updated: April 14, 2011

Status

Affected

Vendor Statement

TLS Command Injection Vulnerability: A TLS Hotfix is available for XCS version 9.0 and 9.1 to resolve a potential command injection vulnerability in the TLS over SMTP implementation. The vulnerability makes it possible to allow a man-in-the-middle to inject commands during the plaintext protocol phase, that would be executed during the ciphertext protocol phase. A full description of the vulnerability is described in CERT Vulnerability Note VU#555316. This fix is included in the XCS 9.0 Update 1 as well as the XCS 9.1 TLS Hotfix updates

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• http://www.watchguard.com/support/release-notes/xcs/
• http://www.watchguard.com/support/release-notes/xcs/9/en-US/EN_ReleaseNotes_XCS_9_1_1/EN_ReleaseNotes_WG_XCS_9_1_TLS_Hotfix.pdf
• http://www.watchguard.com/archive/softwarecenter.asp