Executive Summary
| Summary | |
|---|---|
| Title | mailman security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2005:137 | First vendor Publication | 2005-02-15 |
| Vendor | RedHat | Last vendor Modification | 2005-02-15 |
| Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated mailman packages to correct a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Mailman is software to help manage email discussion lists. A flaw in the true_path function of Mailman was discovered. A remote attacker who is a member of a private mailman list could use a carefully crafted URL and gain access to arbitrary files on the server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0202 to this issue. Note: Mailman installations running on Apache 2.0-based servers are not vulnerable to this issue. Users of Mailman should update to these erratum packages that contain a patch and are not vulnerable to this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ 5. Bug IDs fixed (http://bugzilla.redhat.com/): 147344 - CAN-2005-0202 mailman flaw |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2005-137.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10657 | |||
| Oval ID: | oval:org.mitre.oval:def:10657 | ||
| Title: | dm-crypt in Linux kernel 2.6.15 and earlier does not clear a structure before it is freed, which leads to a memory disclosure that could allow local users to obtain sensitive information about a cryptographic key. | ||
| Description: | Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0202 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 7 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for mailman File : nvt/sles9p5016406.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200502-11 (mailman) File : nvt/glsa_200502_11.nasl |
| 2008-09-04 | Name : FreeBSD Ports: mailman, ja-mailman File : nvt/freebsd_mailman.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 674-1 (mailman) File : nvt/deb_674_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 674-2 (mailman) File : nvt/deb_674_2.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 674-3 (mailman) File : nvt/deb_674_3.nasl |
| 2005-11-03 | Name : Mailman private.py Directory Traversal Vulnerability File : nvt/mailman_privatepy_directory_traversal.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 13671 | Mailman private.py true_path Function Traversal Arbitrary File Access |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | mailman directory traversal attempt RuleID : 3131-community - Revision : 10 - Type : SERVER-WEBAPP |
| 2014-01-10 | mailman directory traversal attempt RuleID : 3131 - Revision : 10 - Type : SERVER-WEBAPP |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2012-09-24 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-131.nasl - Type : ACT_GATHER_INFO |
| 2012-09-24 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-132.nasl - Type : ACT_GATHER_INFO |
| 2006-04-04 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-267-1.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-78-1.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-78-2.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_c7ccc33f7d3111d9a9e70001020eed82.nasl - Type : ACT_GATHER_INFO |
| 2005-03-21 | Name : The remote host is missing a Mac OS X update that fixes a security issue. File : macosx_SecUpd2005-003.nasl - Type : ACT_GATHER_INFO |
| 2005-02-22 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-137.nasl - Type : ACT_GATHER_INFO |
| 2005-02-15 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2005-037.nasl - Type : ACT_GATHER_INFO |
| 2005-02-14 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200502-11.nasl - Type : ACT_GATHER_INFO |
| 2005-02-14 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2005_007.nasl - Type : ACT_GATHER_INFO |
| 2005-02-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-674.nasl - Type : ACT_GATHER_INFO |
| 2005-02-10 | Name : Authenticated Mailman users can view arbitrary files on the remote host. File : mailman_privatepy_directory_traversal.nasl - Type : ACT_GATHER_INFO |
| 2005-02-10 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-136.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:49:04 |
|
