[ GLSA 201401-24 ] INN: Man-in-the-middle attack

[GLSA]

Gentoo Linux Security Advisory

Title: INN: Man-in-the-middle attack (GLSA 201401-24)
Severity: low
Exploitable: remote
Date: January 21, 2014
Bug(s): #432002
ID: 201401-24

Synopsis

A vulnerability in INN's STARTTLS implementation could allow a
remote attacker to conduct a man-in-the-middle attack.


Background

INN is a news server which can interface with Usenet.

Affected Packages

Package: net-nntp/inn
Vulnerable: < 2.5.3
Unaffected: >= 2.5.3
Architectures: All supported architectures


Description

INN’s I/O buffering is not correctly restricted.

Impact

A remote attacker could inject commands into encrypted NNTP sessions.

Workaround

There is no known workaround at this time.

Resolution

All INN users should upgrade to the latest version: