Unknown vulnerability in the mail command handler in Mailman before 2.0.14 allows remote attackers to cause a denial of service (crash) via malformed e-mail commands.

A malformed message could cause mailman to crash.

Several vulnerabilities have been fixed in the mailman package :

  - CAN-2003-0038 - potential cross-site scripting via     certain CGI parameters (not known to be exploitable in     this version)
  - CAN-2003-0965 - cross-site scripting in the     administrative interface

  - CAN-2003-0991 - certain malformed email commands could     cause the mailman process to crash

The cross-site scripting vulnerabilities could allow an attacker to perform administrative operations without authorization, by stealing a session cookie.

A cross-site scripting vulnerability was discovered in mailman's administration interface (CVE-2003-0965). This affects version 2.1 earlier than 2.1.4.

Certain malformed email commands could cause the mailman process to crash. (CVE-2003-0991). This affects version 2.0 earler than 2.0.14.

Another cross-site scripting vulnerability was found in mailman's 'create' CGI script (CVE-2003-0992). This affects version 2.1 earlier than 2.1.3.

An updated mailman package that closes a DoS vulnerability in mailman introduced by RHSA-2004:019 is now available.

Mailman is a mailing list manager.

On February 19 2004, Red Hat issued security erratum RHSA-2004:019 to correct a DoS (Denial of Service) vulnerability where an attacker could send a carefully-crafted message and cause mailman to crash.

Matthew Saltzman discovered a flaw in our original patch intended to correct this vulnerability. This flaw can cause mailman to crash if it receives an email destined for a list with an empty subject field. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0182 to this issue.

Users of Mailman are advised to upgrade to these updated packages, which include an updated patch and are not vulnerable to this issue.

Updated mailman packages that close a DoS vulnerability present in mailman versions prior to version 2.1 are now available.

Mailman is a mailing list manager.

Matthew Galgoci of Red Hat discovered a Denial of Service (DoS) vulnerability in versions of Mailman prior to 2.1. An attacker could send a carefully-crafted message causing mailman to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0991 to this issue.

Users of Mailman are advised to upgrade to the erratum packages, which include a backported security fix and are not vulnerable to this issue.

Red Hat would like to thank Barry Warsaw for providing a patch for this issue.

ID	Name	Product	Family	Severity
37934	FreeBSD : mailman denial-of-service vulnerability in MailCommandHandler (b0e76877-67a8-11d8-80e3-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	medium
15273	Debian DSA-436-1 : mailman - several vulnerabilities	Nessus	Debian Local Security Checks	medium
14113	Mandrake Linux Security Advisory : mailman (MDKSA-2004:013)	Nessus	Mandriva Local Security Checks	medium
12485	RHEL 2.1 : mailman (RHSA-2004:156)	Nessus	Red Hat Local Security Checks	medium
12452	RHEL 2.1 : mailman (RHSA-2004:019)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2003-0991

high

Tenable Plugins

medium

medium

medium

medium

medium