From Red Hat Security Advisory 2006:0600 :

Updated mailman packages that fix security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mailman is a program used to help manage email discussion lists.

A flaw was found in the way Mailman handled MIME multipart messages.
An attacker could send a carefully crafted MIME multipart email message to a mailing list run by Mailman which caused that particular mailing list to stop working. (CVE-2006-2941)

Several cross-site scripting (XSS) issues were found in Mailman. An attacker could exploit these issues to perform cross-site scripting attacks against the Mailman administrator. (CVE-2006-3636)

Red Hat would like to thank Barry Warsaw for disclosing these vulnerabilities.

Users of Mailman should upgrade to these updated packages, which contain backported patches to correct this issue.

This update of mailman fixes the following security issues :

  - A malicious user could visit a specially crafted URI and     inject an apparent log message into Mailman's error log     which might induce an unsuspecting administrator to     visit a phishing site. This has been blocked. Thanks to     Moritz Naumann for its discovery.

  - Fixed denial of service attack which can be caused by     some standards-breaking RFC 2231 formatted headers.
    CVE-2006-2941.

  - Several cross-site scripting issues have been fixed.
    Thanks to Moritz Naumann for their discovery.
    CVE-2006-3636

  - Fixed an unexploitable format string vulnerability.
    Discovery and fix by Karl Chen. Analysis of     non-exploitability by Martin 'Joey' Schulze. Also thanks     go to Lionel Elie Mamane. CVE-2006-2191.

Updated mailman packages that fix security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mailman is a program used to help manage email discussion lists.

A flaw was found in the way Mailman handled MIME multipart messages.
An attacker could send a carefully crafted MIME multipart email message to a mailing list run by Mailman which caused that particular mailing list to stop working. (CVE-2006-2941)

Several cross-site scripting (XSS) issues were found in Mailman. An attacker could exploit these issues to perform cross-site scripting attacks against the Mailman administrator. (CVE-2006-3636)

Red Hat would like to thank Barry Warsaw for disclosing these vulnerabilities.

Users of Mailman should upgrade to these updated packages, which contain backported patches to correct this issue.

Several security related problems have been discovered in mailman, the web-based GNU mailing list manager. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-3636     Moritz Naumann discovered several cross-site scripting     problems that could allow remote attackers to inject     arbitrary web script code or HTML.

  - CVE-2006-4624     Moritz Naumann discovered that a remote attacker can     inject arbitrary strings into the logfile.

Secunia reports :

Mailman can be exploited by malicious people to conduct cross-site scripting and phishing attacks, and cause a DoS (Denial of Service).

1) An error in the logging functionality can be exploited to inject a spoofed log message into the error log via a specially crafted URL.

Successful exploitation may trick an administrator into visiting a malicious website.

2) An error in the processing of malformed headers which does not follow the RFC 2231 standard can be exploited to cause a DoS (Denial of Service).

3) Some unspecified input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

A flaw was discovered in how Mailman handles MIME multipart messages where an attacker could send a carefully-crafted MIME multipart message to a Mailman-run mailing list causing that mailing list to stop working (CVE-2006-2941).

As well, a number of XSS (cross-site scripting) issues were discovered that could be exploited to perform XSS attacks against the Mailman administrator (CVE-2006-3636).

Finally, a CRLF injection vulnerability allows remote attackers to spoof messages in the error log (CVE-2006-4624).

Updated packages have been patched to address these issues.

This update of mailman fixes the following security issues :

  - A malicious user could visit a specially crafted URI and     inject an apparent log message into Mailman's error log     which might induce an unsuspecting administrator to     visit a phishing site. This has been blocked. Thanks to     Moritz Naumann for its discovery.

  - Fixed denial of service attack which can be caused by     some standards-breaking RFC 2231 formatted headers.
    CVE-2006-2941.

  - Several cross-site scripting issues have been fixed.
    Thanks to Moritz Naumann for their discovery.
    CVE-2006-3636: - Fixed an unexploitable format string     vulnerability. Discovery and fix by Karl Chen. Analysis     of non-exploitability by Martin 'Joey' Schulze. Also     thanks go to Lionel Elie Mamane. CVE-2006-2191.

Steve Alexander discovered that mailman did not properly handle attachments with special filenames. A remote user could exploit that to stop mail delivery until the server administrator manually cleaned these posts. (CVE-2006-2941)

Various cross-site scripting vulnerabilities have been reported by Barry Warsaw. By using specially crafted email addresses, names, and similar arbitrary user-defined strings, a remote attacker could exploit this to run web script code in the list administrator's web browser. (CVE-2006-3636)

URLs logged to the error log file are now checked for invalid characters. Before, specially crafted URLs could inject arbitrary messages into the log.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Mailman installed on the remote host fails to sanitize user-supplied input before writing it to the application's 'error' log.  An unauthenticated remote attacker can leverage this flaw to spoof log messages.  In addition, the application is reportedly affected by a denial of service issue involving headers that do not conform to RFC 2231 as well as several cross-site scripting vulnerabilities.

ID	Name	Product	Family	Published	Updated	Severity
67397	Oracle Linux 3 / 4 : mailman (ELSA-2006-0600)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	medium
27344	openSUSE 10 Security Update : mailman (mailman-2170)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	high
22320	CentOS 3 / 4 : mailman (CESA-2006:0600)	Nessus	CentOS Local Security Checks	9/12/2006	1/4/2021	medium
22730	Debian DSA-1188-1 : mailman - format string	Nessus	Debian Local Security Checks	10/14/2006	1/4/2021	medium
22304	FreeBSD : mailman -- Multiple Vulnerabilities (fffa9257-3c17-11db-86ab-00123ffe8333)	Nessus	FreeBSD Local Security Checks	9/5/2006	1/6/2021	high
41102	SuSE9 Security Update : mailman (YOU Patch Number 11243)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	high
23909	Mandrake Linux Security Advisory : mailman (MDKSA-2006:165)	Nessus	Mandriva Local Security Checks	12/16/2006	1/6/2021	medium
29519	SuSE 10 Security Update : mailman (ZYPP Patch Number 2174)	Nessus	SuSE Local Security Checks	12/13/2007	1/14/2021	high
22330	RHEL 3 / 4 : mailman (RHSA-2006:0600)	Nessus	Red Hat Local Security Checks	9/12/2006	1/14/2021	medium
27924	Ubuntu 5.04 / 5.10 / 6.06 LTS : mailman vulnerabilities (USN-345-1)	Nessus	Ubuntu Local Security Checks	11/10/2007	1/19/2021	medium
3737	Mailman < 2.1.9rc1 Spoofed Log Entry Injection	Nessus Network Monitor	CGI	9/5/2006	3/6/2019	medium

Detections

Analytics

Plugins Search

medium

high

medium

medium

high

high

medium

high

medium

medium

medium