Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.

A remote Denial of Service vulnerability was discovered in the decoder for multipart messages. Certain parts of type 'message/delivery-status' or parts containing only two blank lines triggered an exception. An attacker could exploit this to crash Mailman by sending a specially crafted email to a mailing list.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ubuntu Security Announce USN-78-1 described a path traversal vulnerability in the 'private' module of Mailman. Unfortunately this updated mailman package was broken so that the 'private' module could not be executed at all any more. The latest package version fixes this.

We apologize for the inconvenience.

For reference, this is the description of the original USN :

An path traversal vulnerability has been discovered in the 'private' module of Mailman. A flawed path sanitation algorithm allowed the construction of URLS to arbitrary files readable by Mailman. This allowed a remote attacker to retrieve configuration and password databases, private list archives, and other files.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An path traversal vulnerability has been discovered in the 'private' module of Mailman. A flawed path sanitation algorithm allowed the construction of URLS to arbitrary files readable by Mailman. This allowed a remote attacker to retrieve configuration and password databases, private list archives, and other files.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A directory traversal vulnerability in mailman allow remote attackers to read arbitrary files due to inadequate input sanitizing. This could, among other things, lead remote attackers to gaining access to the mailman configuration database (which contains subscriber email addresses and passwords) or to the mail archives for private lists.

The remote host is missing Security Update 2005-003. This security update contains security fixes for the following applications :

  - AFP Server
  - Bluetooth Setup Assistant
  - Core Foundation
  - Cyrus IMAP
  - Cyrus SASL
  - Folder Permissions
  - Mailman
  - Safari

These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:137 advisory.

  - security flaw (CVE-2005-0202)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A vulnerability was discovered in Mailman, which allows a remote directory traversal exploit using URLs of the form '.../....///' to access private Mailman configuration data.

The vulnerability lies in the Mailman/Cgi/private.py file.

Updated packages correct this issue.

The remote host is missing the patch for the advisory SUSE-SA:2005:007 (mailman).


Mailman is a flexible mailing list management tool. It provides mail controlled subscription front ends and also includes CGI scripts to handle subscription, moderation and archive retrieval and other options.

Due to incomplete input validation the 'private' CGI script which handles archive retrieval could be used to read any file on the system, including the configuration database of the mailman lists which include passwords in plain text. A remote attacker just needs a valid account on one mailing list managed by this mailman instance.

This update fixes this problem and is tracked under the Mitre CVE ID CVE-2005-0202.

Please see section (3), 'special instructions and notes'.

Our previous mailman update (only announced in the SUSE Summary Report) additionally fixed the following two security problems:
- a cross site scripting problem (CVE-2004-1177)
- too weak auto generated passwords (CVE-2004-1143)

This previous security fix requires the additional 'python-xml' RPM which was not required before.

The remote host is affected by the vulnerability described in GLSA-200502-11 (Mailman: Directory traversal vulnerability)

    Mailman contains an error in private.py which fails to properly     sanitize input paths.
  Impact :

    An attacker could exploit this flaw to obtain arbitrary files on     the web server.
  Workaround :

    There is no known workaround at this time.

The remote host is running GNU Mailman, a web based software to manage mailing lists.  There is a flaw in this version of Mailman that would allow a remote attacker to retrieve potentially confidential data.  Specifically, the CGI script 'private.py' does not properly parse user-supplied data and would allow an attacker to read any file on the operating system that was readable by the web process.

Updated mailman packages that correct a mailman security issue are now available.

The mailman package is software to help manage email discussion lists.

A flaw in the true_path function of Mailman was discovered. A remote attacker who is a member of a private mailman list could use a carefully crafted URL and gain access to arbitrary files on the server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0202 to this issue.

Note: Mailman installations running on Apache 2.0-based servers are not vulnerable to this issue.

Users of mailman should update to these erratum packages that contain a patch and are not vulnerable to this issue.

Due to an incompatibility between Python 1.5 and 2.1 the last mailman update did not run with Python 1.5 anymore. This problem is corrected with this update. This advisory only updates the packages updated with DSA 674-2. The version in unstable is not affected since it is not supposed to work with Python 1.5 anymore. For completeness below is the original advisory text :

  Two security related problems have been discovered in mailman,   web-based GNU mailing list manager. The Common Vulnerabilities and   Exposures project identifies the following problems :

    - CAN-2004-1177       Florian Weimer discovered a cross-site scripting       vulnerability in mailman's automatically generated       error messages. An attacker could craft a URL       containing JavaScript (or other content embedded into       HTML) which triggered a mailman error page that would       include the malicious code verbatim.

    - CAN-2005-0202

      Several listmasters have noticed unauthorised access       to archives of private lists and the list       configuration itself, including the users passwords.
      Administrators are advised to check the webserver       logfiles for requests that contain '/...../' and the       path to the archives or configuration. This does only       seem to affect installations running on web servers       that do not strip slashes, such as Apache 1.3.

According to its version number, the remote installation of Mailman reportedly is affected by a directory traversal vulnerability in 'Cgi/private.py'.  The flaw comes into play only on web servers that don't strip extraneous slashes from URLs, such as Apache 1.3.x, and allows a list subscriber, using a specially crafted web request, to retrieve arbitrary files from the server - any file accessible by the user under which the web server operates, including email addresses and passwords of subscribers of any lists hosted on the server.  For example, if '$user' and '$pass' identify a subscriber of the list '$listname@$target', then the following URL :

  http://$target/mailman/private/$listname/.../....///mailman?username=$user&password=$pass

allows access to archives for the mailing list named 'mailman' for which the user might not otherwise be entitled.

ID	Name	Product	Family	Severity
21184	Ubuntu 4.10 / 5.04 / 5.10 : mailman vulnerability (USN-267-1)	Nessus	Ubuntu Local Security Checks	medium
20701	Ubuntu 4.10 : mailman vulnerabilities (USN-78-2)	Nessus	Ubuntu Local Security Checks	medium
20700	Ubuntu 4.10 : mailman vulnerabilities (USN-78-1)	Nessus	Ubuntu Local Security Checks	medium
19117	FreeBSD : mailman -- directory traversal vulnerability (c7ccc33f-7d31-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
17587	Mac OS X Multiple Vulnerabilities (Security Update 2005-003)	Nessus	MacOS X Local Security Checks	high
17191	RHEL 4 : mailman (RHSA-2005:137)	Nessus	Red Hat Local Security Checks	high
16461	Mandrake Linux Security Advisory : mailman (MDKSA-2005:037)	Nessus	Mandriva Local Security Checks	medium
16454	SUSE-SA:2005:007: mailman	Nessus	SuSE Local Security Checks	high
16448	GLSA-200502-11 : Mailman: Directory traversal vulnerability	Nessus	Gentoo Local Security Checks	medium
2607	GNU Mailman < 2.1.6 Directory Traversal Arbitrary File Access	Nessus Network Monitor	CGI	medium
16371	RHEL 2.1 / 3 : mailman (RHSA-2005:136)	Nessus	Red Hat Local Security Checks	medium
16348	Debian DSA-674-3 : mailman - XSS, directory traversal	Nessus	Debian Local Security Checks	medium
16339	Mailman private.py true_path Function Traversal Arbitrary File Access	Nessus	CGI abuses	low

Detections

Analytics

CVE-2005-0202

high

Tenable Plugins

medium

medium

medium

medium

high

high

medium

high

medium

medium

medium

medium

low