PatchTheCVECVE-2012-3523: The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allow
CVE-2012-3523 is a medium-severity flaw (CVSS 6.8) affecting inn. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.8 (Medium) |
| EPSS exploit chance | 3.2% (top 12%) |
| CISA exploited list | No |
| Weakness | CWE-264 |
| Published | 2012-11-11 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2012-3523?
inn: upgrade to newer than 2.5.2. Exact commands for each OS are on this page.
Is CVE-2012-3523 being exploited?
CVE-2012-3523 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2012-3523 affect?
CVE-2012-3523 affects inn. Severity is medium (CVSS 6.8). The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TL
How urgent is CVE-2012-3523?
Priority 46/100. No elevated risk signals yet.
Related CVEs
- CVE-2021-31998 MEDIUM 6.8 UPGRADE A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3;
- CVE-2019-3692 HIGH 7.7 UPGRADE DOWNGRADE The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to
- CVE-2004-0045 HIGH 7.5 DOWNGRADE Buffer overflow in the ARTpost function in art.c in the control message handling code for INN 2.4.0 may allow
- CVE-2002-0526 HIGH 7.2 UPGRADE Vulnerability in (1) inews or (2) rnews for INN 2.2.3 and earlier, related to insecure open() calls.
- CVE-2002-0525 HIGH 10.0 DOWNGRADE Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local users and remote