CVE-2012-3523: The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which al...

Security readout for executives and security teams

CVE-2012-3523 affects INN's nnrpd STARTTLS handling before version 2.5.3. A network attacker positioned between client and server could inject plaintext commands that are processed after encryption starts. This can undermine trust in encrypted NNTP sessions, but the source bundle does not provide severity scoring or active exploitation evidence. Exposure is most likely on systems running INN nnrpd before 2.5.3 with STARTTLS enabled, especially internet-facing or untrusted-network NNTP services. The provided affected-product metadata is incomplete, so distribution package checks are necessary. Treat this as a targeted protocol-security fix for legacy NNTP infrastructure. It is not KEV-listed and lacks a severity score, but affected public or shared-network services should be updated because the flaw can compromise encrypted session integrity. Mitigation focus: Upgrade INN to 2.5.3 or a distribution package containing the STARTTLS fix.; Review Mandriva and openSUSE advisories for package-specific fixed versions.; Prioritize externally reachable nnrpd services and shared-network deployments..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.