CVE-2011-1430

Name of the Vulnerable Software and Affected Versions Ipswitch IMail versions 11.03 and earlier

Description The issue is related to the STARTTLS implementation in the server, which does not properly restrict I/O buffering. This allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place. The attack is referred to as a "plaintext command injection" attack.

Recommendations For Ipswitch IMail versions 11.03 and earlier, consider disabling the STARTTLS implementation until a patch is available to prevent man-in-the-middle attackers from inserting commands into encrypted SMTP sessions. Restrict access to the SMTP server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.