Debian DSA-4285-1 : sympa - security update

High Nessus Plugin ID 117297

Synopsis

The remote Debian host is missing a security-related update.

Description

Michael Kaczmarczik discovered a vulnerability in the web interface template editing function of Sympa, a mailing list manager. Owner and listmasters could use this flaw to create or modify arbitrary files in the server with privileges of sympa user or owner view list config files even if edit_list.conf prohibits it.

Solution

Upgrade the sympa packages.

For the stable distribution (stretch), this problem has been fixed in version 6.2.16~dfsg-3+deb9u1.

See Also

https://security-tracker.debian.org/tracker/sympa

https://packages.debian.org/source/stretch/sympa

http://www.debian.org/security/2018/dsa-4285

Plugin Details

Severity: High

ID: 117297

File Name: debian_DSA-4285.nasl

Version: 1.1

Type: local

Agent: unix

Published: 2018/09/06

Modified: 2018/09/06

Dependencies: 12634

Risk Information

Risk Factor: High

CVSSv2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:sympa, cpe:/o:debian:debian_linux:9.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 2018/09/05

Reference Information

CVE: CVE-2018-1000550

DSA: 4285