Debian: DSA-2073-1: New mlmmj packages fix directory traversal

    Date20 Jul 2010
    CategoryDebian
    403
    Posted ByLinuxSecurity Advisories
    Florian Streibelt reported a a directory traversal flaw in the way the Mailing List Managing Made Joyful mailing list manager processed users' requests originating from the administrator web interface without enough input validation. A remote, authenticated attacker could
    
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-2073-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                          Thijs Kinkhorst
    July 20, 2010                         http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : mlmmj
    Vulnerability  : insufficient input sanitising
    Problem type   : remote
    Debian-specific: no
    CVE Id(s)      : CVE-2009-4896
    
    Florian Streibelt reported a a directory traversal flaw in the way the
    Mailing List Managing Made Joyful mailing list manager processed
    users' requests originating from the administrator web interface
    without enough input validation. A remote, authenticated attacker could
    use these flaws to write and / or delete arbitrary files.
    
    For the stable distribution (lenny), these problems have been fixed in
    version 1.2.15-1.1+lenny1.
    
    For the unstable distribution (sid), these problems have been fixed in
    version 1.2.17-1.1.
    
    We recommend that you upgrade your mlmmj package.
    
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 5.0 alias lenny
    - --------------------------------
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15.orig.tar.gz
        Size/MD5 checksum:   211880 da0c43e8767fa9c5460305489f3a2337
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1.dsc
        Size/MD5 checksum:     1027 8b375467bc41396da40532a6d96ddc1f
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1.diff.gz
        Size/MD5 checksum:    89834 e6f785cf58c2c6c1705724558a8020a3
    
    Architecture independent packages:
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
        Size/MD5 checksum:    27310 57e04f940837fa2d7dfdb8f245f21e84
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
        Size/MD5 checksum:    34508 c11ff6b4a1b288ed348918324485cc43
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1_alpha.deb
        Size/MD5 checksum:   188630 17bbe79b5b0c5a3b17ef9239f5fc3c30
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1_amd64.deb
        Size/MD5 checksum:   170808 aa14efc2c2ef5df5a40f4e6484f59d17
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1_arm.deb
        Size/MD5 checksum:   150598 89ab40e66d784d31dd63920a2e08cc77
    
    armel architecture (ARM EABI)
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1_armel.deb
        Size/MD5 checksum:   147308 fb611e200ac1bbc923fc7c3919120bd6
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1_hppa.deb
        Size/MD5 checksum:   170840 e9d3799fac5f0e739e5d0185484ab2b9
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1_i386.deb
        Size/MD5 checksum:   155770 06fe77aa846e3e274736fe8ad463089d
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1_ia64.deb
        Size/MD5 checksum:   230230 ba7dc0277dc1cbcb16977089eed50871
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1_mips.deb
        Size/MD5 checksum:   172190 bf2717f8d066410149ce09cbf2e20112
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1_mipsel.deb
        Size/MD5 checksum:   169064 089d638146a56e12db415bc0d3ee499d
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1_powerpc.deb
        Size/MD5 checksum:   165234 b6f97aca0deadf53e487b86480162e11
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1_s390.deb
        Size/MD5 checksum:   156462 c0b2f321cb32e51d0c9a7d565f9d0549
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+lenny1_sparc.deb
        Size/MD5 checksum:   155724 da07375aafb78c34e37817551deef50b
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and http://packages.debian.org/
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"25","type":"x","order":"1","pct":54.35,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":10.87,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"16","type":"x","order":"3","pct":34.78,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.