Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page.

Florian Weimer discovered a cross-site scripting vulnerability in mailman's automatically generated error messages. An attacker could craft an URL containing JavaScript (or other content embedded into HTML) which triggered a mailman error page. When an unsuspecting user followed this URL, the malicious content was copied unmodified to the error page and executed in the context of this page.

Juha-Matti Tapio discovered an information disclosure in the private rosters management. Everybody could check whether a specified email address was subscribed to a private mailing list by looking at the error message. This bug was Ubuntu/Debian specific.

Important note :

There is currently another known vulnerability: when an user subscribes to a mailing list without choosing a password, mailman automatically generates one. However, there are only about 5 million different possible passwords which allows brute-force attacks.

A different password generation algorithm already exists, but is currently too immature to be put into a stable release security update. Therefore it is advisable to always explicitly choose a password for subscriptions, at least until this gets fixed in Warty Warthog.

See https://bugzilla.ubuntu.com/4892 for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A cross-site scripting (XSS) flaw in the driver script of mailman prior to version 2.1.5 could allow remote attackers to execute scripts as other web users. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1177 to this issue.

Users of mailman should update to this erratum package, which corrects this issue by turning on STEALTH_MODE by default and using Utils.websafe() to quote the html.

In addition this version of the rpm includes a utility script in /usr/share/doc/mailman-*/contrib/migrate-fhs that can be run if the user has installed an FC3 or FC4 mailman rpm over an older non-FHS compliant mailman installation. The script will aid in moving the file locations from the old directory structure to the new FHS mailman directory structure that are present in FC3, FC4, and RHEL4. Users who have installed mailman originally from FC3, FC4 or RHEL4 will not need to migration any file locations.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A cross-site scripting (XSS) flaw in the driver script of mailman prior to version 2.1.5 could allow remote attackers to execute scripts as other web users. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1177 to this issue.

Users of mailman should update to this erratum package, which corrects this issue by turning on STEALTH_MODE by default and using Utils.websafe() to quote the html.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:235 advisory.

    Mailman manages electronic mail discussion and e-newsletter lists.

    A cross-site scripting (XSS) flaw in the driver script of mailman prior to     version 2.1.5 could allow remote attackers to execute scripts as other web     users. The Common Vulnerabilities and Exposures project (cve.mitre.org)     has assigned the name CAN-2004-1177 to this issue.

    Users of mailman should update to this erratum package, which corrects this     issue by turning on STEALTH_MODE by default and using Utils.websafe() to     quote the html.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is missing the patch for the advisory SUSE-SA:2005:007 (mailman).


Mailman is a flexible mailing list management tool. It provides mail controlled subscription front ends and also includes CGI scripts to handle subscription, moderation and archive retrieval and other options.

Due to incomplete input validation the 'private' CGI script which handles archive retrieval could be used to read any file on the system, including the configuration database of the mailman lists which include passwords in plain text. A remote attacker just needs a valid account on one mailing list managed by this mailman instance.

This update fixes this problem and is tracked under the Mitre CVE ID CVE-2005-0202.

Please see section (3), 'special instructions and notes'.

Our previous mailman update (only announced in the SUSE Summary Report) additionally fixed the following two security problems:
- a cross site scripting problem (CVE-2004-1177)
- too weak auto generated passwords (CVE-2004-1143)

This previous security fix requires the additional 'python-xml' RPM which was not required before.

The remote host is affected by the vulnerability described in GLSA-200501-29 (Mailman: XSS vulnerability)

    Florian Weimer has discovered a cross-site scripting vulnerability     in the error messages that are produced by Mailman.
  Impact :

    By enticing a user to visiting a specially crafted URL, an     attacker can execute arbitrary script code running in the context of     the victim's browser.
  Workaround :

    There is no known workaround at this time.

Due to an incompatibility between Python 1.5 and 2.1 the last mailman update did not run with Python 1.5 anymore. This problem is corrected with this update. This advisory only updates the packages updated with DSA 674-2. The version in unstable is not affected since it is not supposed to work with Python 1.5 anymore. For completeness below is the original advisory text :

  Two security related problems have been discovered in mailman,   web-based GNU mailing list manager. The Common Vulnerabilities and   Exposures project identifies the following problems :

    - CAN-2004-1177       Florian Weimer discovered a cross-site scripting       vulnerability in mailman's automatically generated       error messages. An attacker could craft a URL       containing JavaScript (or other content embedded into       HTML) which triggered a mailman error page that would       include the malicious code verbatim.

    - CAN-2005-0202

      Several listmasters have noticed unauthorised access       to archives of private lists and the list       configuration itself, including the users passwords.
      Administrators are advised to check the webserver       logfiles for requests that contain '/...../' and the       path to the archives or configuration. This does only       seem to affect installations running on web servers       that do not strip slashes, such as Apache 1.3.

Florian Weimer discovered a vulnerability in Mailman, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input is not properly sanitised by 'scripts/driver' when returning error pages. This can be exploited to execute arbitrary HTML or script code in a user's browser session in context of a vulnerable site by tricking a user into visiting a malicious web site or follow a specially crafted link. (CVE-2004-1177).

ID	Name	Product	Family	Severity
20677	Ubuntu 4.10 : mailman vulnerabilities (USN-59-1)	Nessus	Ubuntu Local Security Checks	medium
19630	Fedora Core 3 : mailman-2.1.5-32.fc3 (2005-242)	Nessus	Fedora Local Security Checks	medium
18318	Fedora Core 2 : mailman-2.1.5-10.fc2 (2005-241)	Nessus	Fedora Local Security Checks	medium
17589	RHEL 4 : mailman (RHSA-2005:235)	Nessus	Red Hat Local Security Checks	medium
16454	SUSE-SA:2005:007: mailman	Nessus	SuSE Local Security Checks	high
16420	GLSA-200501-29 : Mailman: XSS vulnerability	Nessus	Gentoo Local Security Checks	medium
16348	Debian DSA-674-3 : mailman - XSS, directory traversal	Nessus	Debian Local Security Checks	medium
16243	Mandrake Linux Security Advisory : mailman (MDKSA-2005:015)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2004-1177

medium

Tenable Plugins

medium

medium

medium

medium

high

medium

medium

medium