Linux Security
Linux Security
Linux Security

Debian: mailman vulnerability

Date 06 Aug 2000
3020
Posted By LinuxSecurity Advisories
Exploit exists that could result in a malicious user obtaining group mailman permission.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ----------------------------------------------------------------------------
Debian Security Advisory                                 This email address is being protected from spambots. You need JavaScript enabled to view it. 
https://www.debian.org/security/                               Martin Schulze
August 5, 2000
- ----------------------------------------------------------------------------

Package: mailman
Vulnerability: local mailman group exploit
Debian-specific: no

Former versions of mailman v2.0 came with a security problem,
introduced during the 2.0 beta cycle, that could be exploited by
clever local users to gain group mailman permission.  No exploit does
exist at the moment, though.

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.


Debian GNU/Linux 2.1 alias slink
- --------------------------------

  Slink comes with version 1.0 that is not vulnerable.

Debian 2.2 alias potato
- -----------------------

  Potato comes with version 1.1 that is not vulnerable.

Debian Unstable alias woody
- ---------------------------

  This version of Debian is not yet released and reflects the current
  development release.  Fixes are currently available for Intel ia32
  and Motorola 680x0.  Fixes for other architectures will be available
  soon.  In doubt, please recompile the package from source on your
  own.

  Source archives:

     ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5-1.diff.gz
      MD5 checksum: 177e666144c35d6b945b30dddf567fef
     ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5-1.dsc
      MD5 checksum: 431d66e4ef496ce48463ed55193d375c
     ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5.orig.tar.gz
      MD5 checksum: 2c2602b7745a56adecd4f24fdd6d446f

  Intel ia32 architecture:

     ftp://ftp.debian.org/debian/dists/woody/main/binary-i386/mail/mailman_2.0beta5-1.deb
      MD5 checksum: e2a071bf4a9a3be02978df47ed58acb6

  Motorola 680x0 architecture:

     ftp://ftp.debian.org/debian/dists/woody/main/binary-m68k/mail/mailman_2.0beta5-1.deb
      MD5 checksum: 8bb6367c1e249beaaaa8eb3b7fc71c27

- ----------------------------------------------------------------------------
For apt-get: deb  https://security.debian.org/ stable updates
For dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates
Mailing list: debian-security-This email address is being protected from spambots. You need JavaScript enabled to view it.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see  https://www.gnupg.org

iD8DBQE5jVi0W5ql+IAeqTIRAntHAJ4qPqO9uLQirRFsl48T5Uv729A6/QCfUAiJ
k+20YJsL9L3+SBCkm2KOxic=
=7iAZ
-----END PGP SIGNATURE-----

Advisories

LinuxSecurity Poll

How frequently do you patch/update your system?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum 0 answer(s) and maximum 3 answer(s).
/main-polls/52-how-frequently-do-you-patch-update-your-system?task=poll.vote&format=json
52
radio
[{"id":"179","title":"As soon as patches\/updates are released - I track advisories for my distro(s) diligently","votes":"50","type":"x","order":"1","pct":80.65,"resources":[]},{"id":"180","title":"Every so often, when I think of it","votes":"7","type":"x","order":"2","pct":11.29,"resources":[]},{"id":"181","title":"Hardly ever","votes":"5","type":"x","order":"3","pct":8.06,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

Please vote first in order to view vote results.

VOTE ON THE POLL PAGE


VIEW MORE POLLS

bottom 200

Please enable / Bitte aktiviere JavaScript!
Veuillez activer / Por favor activa el Javascript![ ? ]

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.