Executive Summary

Summary
Title mailman vulnerability
Informations
Name USN-267-1 First vendor Publication 2006-04-03
Vendor Ubuntu Last vendor Modification 2006-04-03
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) Ubuntu 5.10 (Breezy Badger)

The following packages are affected:

mailman

The problem can be corrected by upgrading the affected package to version 2.1.5-1ubuntu2.7 (for Ubuntu 4.10), 2.1.5-7ubuntu0.2 (for Ubuntu 5.04), or 2.1.5-8ubuntu2.2 (for Ubuntu 5.10). In general, a standard system upgrade is sufficient to effect the necessary changes.

Details follow:

A remote Denial of Service vulnerability was discovered in the decoder for multipart messages. Certain parts of type "message/delivery-status" or parts containing only two blank lines triggered an exception. An attacker could exploit this to crash Mailman by sending a specially crafted email to a mailing list.

Original Source

Url : http://www.ubuntu.com/usn/USN-267-1

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:9475
 
Oval ID: oval:org.mitre.oval:def:9475
Title: The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary.
Description: The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary.
Family: unix Class: vulnerability
Reference(s): CVE-2006-0052
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 27

OpenVAS Exploits

Date Description
2009-10-10 Name : SLES9: Security update for Mailman
File : nvt/sles9p5019648.nasl
2008-01-17 Name : Debian Security Advisory DSA 1027-1 (mailman)
File : nvt/deb_1027_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
24367 Mailman Scrubber.py Crafted Multipart MIME Message DoS

Mailman contains a flaw that may allow a remote denial of service. The issue is triggered when a multipart MIME message with a malformed part is received by the 'Scrubber.py' script, and will result in loss of availability for the list.

Nessus® Vulnerability Scanner

Date Description
2006-10-14 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1027.nasl - Type : ACT_GATHER_INFO
2006-07-03 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2006-0486.nasl - Type : ACT_GATHER_INFO
2006-06-11 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2006-0486.nasl - Type : ACT_GATHER_INFO
2006-04-04 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-267-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 12:03:22
  • Multiple Updates