- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200609-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Mailman: Multiple vulnerabilities Date: September 19, 2006 Bugs: #139976 ID: 200609-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Mailman has multiple vulnerable that can result in Denial of Service, log file injection and XSS. Background ========== Mailman is a Python based mailing list server with an extensive web interface. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-mail/mailman < 2.1.9_rc1 >= 2.1.9_rc1 Description =========== Mailman fails to properly handle standards-breaking RFC 2231 formatted headers. Furthermore, Moritz Naumann discovered several XSS vulnerabilities and a log file injection. Impact ====== An attacker could exploit these vulnerabilities to cause Mailman to stop processing mails, to inject content into the log file or to execute arbitrary scripts running in the context of the administrator or mailing list user's browser. Workaround ========== There is no known workaround at this time. Resolution ========== All Mailman users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/mailman-2.1.9_rc1" References ========== [ 1 ] CVE-2006-2941 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2941 [ 2 ] CVE-2006-3636 http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-3636 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200609-12.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@xxxxxxxxxx or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2006 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5
Attachment:
pgpZ2mRbUx7aN.pgp
Description: PGP signature