Scientific Linux Security Update : mailman on SL6.x i386/x86_64

This script is Copyright (C) 2015 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

It was found that mailman did not sanitize the list name before
passing it to certain MTAs. A local attacker could use this flaw to
execute arbitrary code as the user running mailman. (CVE-2015-2775)

It was found that mailman stored private email messages in a world-
readable directory. A local user could use this flaw to read private
mailing list archives. (CVE-2002-0389)

This update also fixes the following bugs :

- Previously, it was impossible to configure Mailman in a
way that Domain- based Message Authentication, Reporting
& Conformance (DMARC) would recognize Sender
alignment for Domain Key Identified Mail (DKIM)
signatures. Consequently, Mailman list subscribers that
belonged to a mail server with a 'reject' policy for
DMARC, such as yahoo.com or AOL.com, were unable to
receive Mailman forwarded messages from senders residing
in any domain that provided DKIM signatures. With this
update, domains with a 'reject' DMARC policy are
recognized correctly, and Mailman list administrators
are able to configure the way these messages are
handled. As a result, after a proper configuration,
subscribers now correctly receive Mailman forwarded
messages in this scenario.

- Mailman used a console encoding when generating a
subject for a 'welcome email' when new mailing lists
were created by the 'newlist' command. Consequently,
when the console encoding did not match the encoding
used by Mailman for that particular language, characters
in the 'welcome email' could be displayed incorrectly.
Mailman has been fixed to use the correct encoding, and
characters in the 'welcome email' are now displayed
properly.

- The 'rmlist' command used a hard-coded path to list data
based on the VAR_PREFIX configuration variable. As a
consequence, when the list was created outside of
VAR_PREFIX, it was impossible to remove it using the
'rmlist' command. With this update, the 'rmlist' command
uses the correct LIST_DATA_DIR value instead of
VAR_PREFIX, and it is now possible to remove the list in
described situation.

- Due to an incompatibility between Python and Mailman in
Scientific Linux 6, when moderators were approving a
moderated message to a mailing list and checked the
'Preserve messages for the site administrator' checkbox,
Mailman failed to approve the message and returned an
error. This incompatibility has been fixed, and Mailman
now approves messages as expected in this scenario.

- When Mailman was set to not archive a list but the
archive was not set to private, attachments sent to that
list were placed in a public archive. Consequently,
users of Mailman web interface could list private
attachments because httpd configuration of public
archive directory allows listing all files in the
archive directory. The httpd configuration of Mailman
has been fixed to not allow listing of private archive
directory, and users of Mailman web interface are no
longer able to list private attachments.

See also :

http://www.nessus.org/u?6ff12003

Solution :

Update the affected mailman and / or mailman-debuginfo packages.

Risk factor :

High / CVSS Base Score : 7.6
(CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 85201 ()

Bugtraq ID:

CVE ID: CVE-2002-0389
CVE-2015-2775

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now