Oracle Sun Java System Messaging Server contains a flaw related to the TLS implementation within the SMTP, IMAP and POP servers failing to properly clear transport layer buffers when changing from plaintext to ciphertext upon receipt of the 'STARTTLS' command. This may allow a remote attacker to inject arbitrary plaintext data which will be executed upon transition to ciphertext.

Currently, there are no known workarounds or upgrades to correct this issue. However, Oracle has released a patch to address this vulnerability. Check the vendor advisory or solution in the references section.

• Security Tracker: 1025179
• CVE ID: 2011-0411 (see also: NVD)
• Secunia Advisory ID: 43646 43874 44301 44327 44506 44863 46417
• Bugtraq ID: 46767
• CERT VU: 555316
• ISS X-Force ID: 65932
• Related OSVDB ID: 71021
• VUPEN Advisory: ADV-2011-0611 ADV-2011-0752 ADV-2011-0891
• Vendor Specific News/Changelog Entry: http://kolab.org/pipermail/kolab-announce/2011/000101.html
  http://lists.opensuse.org/opensuse-updates/2011-04/msg00068.html
  http://www.kb.cert.org/vuls/id/MORO-8ELH6Z
  http://www.postfix.org/CVE-2011-0411.html
• Mail List Post: http://lists.apple.com/archives/security-announce/2011/Oct//msg00003.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056559.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056560.html
  http://seclists.org/fulldisclosure/2011/Apr/288
• Vendor Specific Advisory URL: http://support.apple.com/kb/HT5002
• News Article: http://www.computerworld.com/s/article/9215838/Oracle_to_fix_73_security_bugs_next_week
• Other Advisory URL: http://www.debian.org/security/2011/dsa-2233
• Vendor Specific Solution URL: http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html#AppendixSUNS
• RedHat RHSA: RHSA-2011:0422 RHSA-2011:0423

• Not Available