CVE ID:	CVE-2011-1926
Description:	The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
Test IDs:	1.3.6.1.4.1.25623.1.0.69790   1.3.6.1.4.1.25623.1.0.880536   1.3.6.1.4.1.25623.1.0.863273   1.3.6.1.4.1.25623.1.0.69965   1.3.6.1.4.1.25623.1.0.122148   1.3.6.1.4.1.25623.1.0.70009   1.3.6.1.4.1.25623.1.0.69871   1.3.6.1.4.1.25623.1.0.69866   1.3.6.1.4.1.25623.1.0.863281   1.3.6.1.4.1.25623.1.0.870443   1.3.6.1.4.1.25623.1.0.880958   1.3.6.1.4.1.25623.1.0.69740   1.3.6.1.4.1.25623.1.0.881403   1.3.6.1.4.1.25623.1.0.881318
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1926 1025625 http://www.securitytracker.com/id?1025625 44670 http://secunia.com/advisories/44670 44876 http://secunia.com/advisories/44876 44913 http://secunia.com/advisories/44913 44928 http://secunia.com/advisories/44928 DSA-2242 http://www.debian.org/security/2011/dsa-2242 DSA-2258 http://www.debian.org/security/2011/dsa-2258 FEDORA-2011-7193 http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061415.html FEDORA-2011-7217 http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061374.html MDVSA-2011:100 http://www.mandriva.com/security/advisories?name=MDVSA-2011:100 RHSA-2011:0859 http://www.redhat.com/support/errata/RHSA-2011-0859.html VU#555316 http://www.kb.cert.org/vuls/id/555316 [oss-security] 20110517 CVE Request -- Cyrus-IMAP STARTTLS issue -- [was: Re: pure-ftpd STARTTLS command injection / new CVE?] http://openwall.com/lists/oss-security/2011/05/17/2 [oss-security] 20110517 Re: CVE Request -- Cyrus-IMAP STARTTLS issue -- [was: Re: pure-ftpd STARTTLS command injection / new CVE?] http://openwall.com/lists/oss-security/2011/05/17/15 cyrus-starttls-command-exec(67867) https://exchange.xforce.ibmcloud.com/vulnerabilities/67867 http://bugzilla.cyrusimap.org/show_bug.cgi?id=3423 http://bugzilla.cyrusimap.org/show_bug.cgi?id=3423 http://bugzilla.cyrusimap.org/show_bug.cgi?id=3424 http://bugzilla.cyrusimap.org/show_bug.cgi?id=3424 http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162 http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162 http://www.cyrusimap.org/docs/cyrus-imapd/2.4.7/changes.php http://www.cyrusimap.org/docs/cyrus-imapd/2.4.7/changes.php https://bugzilla.redhat.com/show_bug.cgi?id=705288 https://bugzilla.redhat.com/show_bug.cgi?id=705288