The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary.

A potential denial of service problem has been discovered in mailman, the web-based GNU mailing list manager. The (failing) parsing of messages with malformed mime multiparts sometimes caused the whole mailing list to become inoperative.

The old stable distribution (woody) is not vulnerable to this issue.

An updated mailman package that fixes a denial of service flaw is now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mailman is software to help manage email discussion lists.

A flaw was found in the way Mailman handles MIME multipart messages.
An attacker could send a carefully crafted MIME multipart email message to a mailing list run by Mailman which would cause that particular mailing list to stop working. (CVE-2006-0052)

Users of Mailman should upgrade to this updated package, which contains backported patches to correct this issue.

A remote Denial of Service vulnerability was discovered in the decoder for multipart messages. Certain parts of type 'message/delivery-status' or parts containing only two blank lines triggered an exception. An attacker could exploit this to crash Mailman by sending a specially crafted email to a mailing list.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running GNU Mailman, a web based software to manage mailing lists.  There is a flaw in this version of Mailman that would allow a remote attacker to retrieve potentially confidential data.  Specifically, the CGI script 'private.py' does not properly parse user-supplied data and would allow an attacker to read any file on the operating system that was readable by the web process.

ID	Name	Product	Family	Severity
22569	Debian DSA-1027-1 : mailman - programming error	Nessus	Debian Local Security Checks	medium
21901	CentOS 3 / 4 : mailman (CESA-2006:0486)	Nessus	CentOS Local Security Checks	medium
21682	RHEL 3 / 4 : mailman (RHSA-2006:0486)	Nessus	Red Hat Local Security Checks	medium
21184	Ubuntu 4.10 / 5.04 / 5.10 : mailman vulnerability (USN-267-1)	Nessus	Ubuntu Local Security Checks	medium
2607	GNU Mailman < 2.1.6 Directory Traversal Arbitrary File Access	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2006-0052

high

Tenable Plugins

medium

medium

medium

medium

medium