Ausführen beliebiger Kommandos in MailMan
ID: | USN-2558-1 |
Distribution: | Ubuntu |
Plattformen: | Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 14.10 |
Datum: | Di, 7. April 2015, 18:47 |
Referenzen: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2775 |
Applikationen: | MailMan |
Originalnachricht |
|
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============0956706096882140839== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="puOTWq1hbHOElFqquXnmJ444aFCvrdeKS" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --puOTWq1hbHOElFqquXnmJ444aFCvrdeKS Content-Type: text/plain; charset=utf- Content-Transfer-Encoding: quoted-printable ========================================================================== Ubuntu Security Notice USN-2558-1 April 07, 2015 mailman vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Mailman could be made to run programs if it processed a specially crafted list name. Software Description: - mailman: Powerful, web-based mailing list manager Details: It was discovered that Mailman incorrectly handled special characters in list names. A local attacker could use this issue to perform a path traversal attack and execute arbitrary code as the Mailman user. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.10: mailman 1:2.1.18-1ubuntu0.1 Ubuntu 14.04 LTS: mailman 1:2.1.16-2ubuntu0.1 Ubuntu 12.04 LTS: mailman 1:2.1.14-3ubuntu0.2 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2558-1 CVE-2015-2775 Package Information: https://launchpad.net/ubuntu/+source/mailman/1:2.1.18-1ubuntu0.1 https://launchpad.net/ubuntu/+source/mailman/1:2.1.16-2ubuntu0.1 https://launchpad.net/ubuntu/+source/mailman/1:2.1.14-3ubuntu0.2 --puOTWq1hbHOElFqquXnmJ444aFCvrdeKS Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJVI/1UAAoJEGVp2FWnRL6TyvgQAKkKDD2Vo4XBRDfkZKWqZp+p f6R9Gx0u7WgWHBjOWLyEH+Hx+urfuH/p1LBVa0o72QkSuNI9PSOI80XhvLd8Q56Z VeqxawO2Reno/+KgZuES+K3c2e3MpQc8TpH5Si9Hj3szmsvnMwoBRD6NlSSMzWvx 3OeGTC5yLbtvXy9LPDL+vnXzT1M0KoCFr4SAsgEza9cabZK7/Z1gvaUxhAsEMk4/ u8xKgTBgVHZnPGWWXbZKcPaiU8bfBcYufjinfTPMzVvqdLwEqjBBq+EQUoMEzX6h smC1WCQZNj1JfDHL6Bk08s1Tcg1Q1o2Ov+OvWLj+IRAYr0zSVp8xkclfGgMRS+2i 5KJWG8UjBOcUoTZJ0hhgHBo1Pat3KlKbZZy434In7x321c/4ThjzwOcyP7ZxGcZF YxG0eGoEyJpa79kSz05PpO4IFIkRTR7xrCV0hNsZPRaGLSe2HGCOk2SqIJoraBwJ Qyb6xGKXD5YWe5WOLg8BeLfUx6IGppI+kuj8bb9IVwH+OWxwCjYSLmsGBzhxwkxE jniLHc5IQRia464CI9rP/Gs0ukT/mbhJZFD6URMPnfevOUKOZxity90QsViaHnNA MfeNumr3BaS6Dmg7AZ80iEpk7rfWYAXLiXQPLVHiwwKGu22hPUEuNnkzyy0JqT1a m/hpsUuctDnxeiC1NPL6 =G9KJ -----END PGP SIGNATURE----- --puOTWq1hbHOElFqquXnmJ444aFCvrdeKS-- --===============0956706096882140839== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce --===============0956706096882140839==-- |