The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0465 advisory.

    This advisory aggregates security fixes for the nginx SRPM in CIQ LTS 9.2. It addresses 18 CVEs:
    CVE-2016-0742, CVE-2018-16845, CVE-2021-3618, CVE-2013-2028, CVE-2018-16843, and 13 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1381 advisory.

    This advisory aggregates security fixes for the nginx SRPM in CIQ LTS 9.6. It addresses 18 CVEs:
    CVE-2016-0742, CVE-2018-16845, CVE-2021-3618, CVE-2013-2028, CVE-2018-16843, and 13 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the self-reported version in the server response header, the version of nginx installed on the remote host is 1.5.6 or higher, 1.6.x prior to 1.6.1, or 1.7.x prior to 1.7.4. It is, therefore, affected by a command injection vulnerability. A flaw exists in the function 'ngx_mail_smtp_starttls' within the file 'src/mail/ngx_mail_smtp_handler.c' whereby input to the STARTTLS command is not properly sanitized. This could allow a remote attacker in a privileged network position to obtain sensitive information by injecting commands into an SSL session. This issue is exploitable only when nginx is used as an SMTP proxy.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of nginx installed on the remote host is 1.5.6 or higher, 1.6.x prior to 1.6.1, or 1.7.x prior to 1.7.4. It is, therefore, affected by a command injection vulnerability.

A flaw exists in the function 'ngx_mail_smtp_starttls' within the file 'src/mail/ngx_mail_smtp_handler.c' whereby input to the STARTTLS command is not properly sanitized. This could allow a remote attacker in a privileged network position to obtain sensitive information by injecting commands into an SSL session.

Note that this issue is exploitable only when nginx is used as an SMTP proxy.

The nginx project reports :

Security: pipelined commands were not discarded after STARTTLS command in SMTP proxy (CVE-2014-3556); the bug had appeared in 1.5.6.

ID	Name	Product	Family	Type	Severity
354474	Rocky Linux 9.2 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0465)	Nessus	Rocky Linux Local Security Checks	Local	medium
354203	Rocky Linux 9.6 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_1381)	Nessus	Rocky Linux Local Security Checks	Local	critical
98958	Nginx < 1.6.1 SMTP STARTTLS Command Injection	Web App Scanning	Component Vulnerability	Version Based	high
98957	Nginx < 1.7.4 SMTP STARTTLS Command Injection	Web App Scanning	Component Vulnerability	Version Based	high
77246	nginx < 1.6.1 / 1.7.4 SMTP STARTTLS Command Injection	Nessus	Web Servers	Combined	medium
77109	FreeBSD : nginx -- inject commands into SSL session vulnerability (ad747a01-1fee-11e4-8ff1-f0def16c5c1b)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2014-3556

high

Tenable Plugins

medium

critical

high

high

medium

medium