CVE-2011-0411
NoneCVSS
—
EPSS
16.3%
Published
Mar 16, 2011
CISA due date
—
The record
The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | postfix | 0 | 2.8.0-1 |
| Debian:12 | postfix | 0 | 2.8.0-1 |
| Debian:13 | postfix | 0 | 2.8.0-1 |
| Debian:5.0 | postfix | 0 | 2.5.5-1.1+lenny1 |
| Debian:6.0 | postfix | 0 | 2.7.1-1+squeeze1 |
| Red Hat:enterprise_linux:4::as | postfix | 0 | 2:2.2.10-1.4.el4 |
| Red Hat:enterprise_linux:4::as | postfix-debuginfo | 0 | 2:2.2.10-1.4.el4 |
| Red Hat:enterprise_linux:4::as | postfix-pflogsumm | 0 | 2:2.2.10-1.4.el4 |
| Red Hat:enterprise_linux:4::desktop | postfix | 0 | 2:2.2.10-1.4.el4 |
| Red Hat:enterprise_linux:4::desktop | postfix-debuginfo | 0 | 2:2.2.10-1.4.el4 |
| Red Hat:enterprise_linux:4::desktop | postfix-pflogsumm | 0 | 2:2.2.10-1.4.el4 |
| Red Hat:enterprise_linux:4::es | postfix | 0 | 2:2.2.10-1.4.el4 |
| Red Hat:enterprise_linux:4::es | postfix-debuginfo | 0 | 2:2.2.10-1.4.el4 |
| Red Hat:enterprise_linux:4::es | postfix-pflogsumm | 0 | 2:2.2.10-1.4.el4 |
| Red Hat:enterprise_linux:4::ws | postfix | 0 | 2:2.2.10-1.4.el4 |
| Red Hat:enterprise_linux:4::ws | postfix-debuginfo | 0 | 2:2.2.10-1.4.el4 |
| Red Hat:enterprise_linux:4::ws | postfix-pflogsumm | 0 | 2:2.2.10-1.4.el4 |
| Red Hat:enterprise_linux:5::server | postfix | 0 | 2:2.3.3-2.2.el5_6 |
| Red Hat:enterprise_linux:5::server | postfix-debuginfo | 0 | 2:2.3.3-2.2.el5_6 |
| Red Hat:enterprise_linux:5::server | postfix-pflogsumm | 0 | 2:2.3.3-2.2.el5_6 |
| Red Hat:enterprise_linux:6::client | postfix | 0 | 2:2.6.6-2.1.el6_0 |
| Red Hat:enterprise_linux:6::client | postfix-debuginfo | 0 | 2:2.6.6-2.1.el6_0 |
| Red Hat:enterprise_linux:6::client | postfix-perl-scripts | 0 | 2:2.6.6-2.1.el6_0 |
| Red Hat:enterprise_linux:6::computenode | postfix | 0 | 2:2.6.6-2.1.el6_0 |
| Red Hat:enterprise_linux:6::computenode | postfix-debuginfo | 0 | 2:2.6.6-2.1.el6_0 |
| Red Hat:enterprise_linux:6::computenode | postfix-perl-scripts | 0 | 2:2.6.6-2.1.el6_0 |
| Red Hat:enterprise_linux:6::server | postfix | 0 | 2:2.6.6-2.1.el6_0 |
| Red Hat:enterprise_linux:6::server | postfix-debuginfo | 0 | 2:2.6.6-2.1.el6_0 |
| Red Hat:enterprise_linux:6::server | postfix-perl-scripts | 0 | 2:2.6.6-2.1.el6_0 |
| Red Hat:enterprise_linux:6::workstation | postfix | 0 | 2:2.6.6-2.1.el6_0 |
| Red Hat:enterprise_linux:6::workstation | postfix-debuginfo | 0 | 2:2.6.6-2.1.el6_0 |
| Red Hat:enterprise_linux:6::workstation | postfix-perl-scripts | 0 | 2:2.6.6-2.1.el6_0 |
| openSUSE:Tumbleweed | pure-ftpd | 0 | 1.0.43-1.3 |
Related vulnerabilities
- CVE-2023-51764 Postfix through 3.8.5 allows SMTP smuggling unless configured with… Also affects postfix
- CVE-2011-1720 The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and… Also affects postfix
- CVE-2003-0540 The address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a… Also affects postfix
- CVE-2024-48208 pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. Also affects pure-ftpd
- CVE-2026-81644 DoS vulnerability in the preview service module. CWE-264
- CVE-2026-49315 DoS vulnerability in the input device module. CWE-264
- CVE-2026-49313 Permission control vulnerability in the app lock module. CWE-264
- CVE-2026-49312 Permission control vulnerability in the window module. CWE-264