Login
Newsletter
Werbung

Sicherheit: Preisgabe von Informationen in mailman
Aktuelle Meldungen Distributionen
Name: Preisgabe von Informationen in mailman
ID: USN-78-1
Distribution: Ubuntu
Plattformen: Ubuntu 4.10
Datum: Do, 10. Februar 2005, 12:00
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0202
Applikationen: MailMan

Originalnachricht

===========================================================
Ubuntu Security Notice USN-78-1 February 09, 2005
mailman vulnerabilities
CAN-2005-0202
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

mailman

The problem can be corrected by upgrading the affected package to
version 2.1.5-1ubuntu2.3. In general, a standard system upgrade is
sufficient to effect the necessary changes.

Details follow:

An path traversal vulnerability has been discovered in the "private"
module of Mailman. A flawed path sanitation algorithm allowed the
construction of URLS to arbitrary files readable by Mailman. This
allowed a remote attacker to retrieve configuration and password
databases, private list archives, and other files.

Source archives:

mailman_2.1.5-1ubuntu2.3.diff.gz
Size/MD5: 127209 e37f6db6c8865ce3ef25f059b2eb953d
mailman_2.1.5-1ubuntu2.3.dsc
Size/MD5: 658 01146e7ec488733d760c14c58f5267db
mailman_2.1.5.orig.tar.gz
Size/MD5: 5745912 f5f56f04747cd4aff67427e7a45631af

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

mailman_2.1.5-1ubuntu2.3_amd64.deb
Size/MD5: 6602410 4f9448fabe11cb71d8946820988cd92c

i386 architecture (x86 compatible Intel/AMD)

mailman_2.1.5-1ubuntu2.3_i386.deb
Size/MD5: 6601808 dda12aca142243dac243268acd9109e8

powerpc architecture (Apple Macintosh G3/G4/G5)

mailman_2.1.5-1ubuntu2.3_powerpc.deb
Size/MD5: 6610862 135e0c700546df9a4ff65025a9edaeea





--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
http://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung