Format string vulnerability in Mailman before 2.1.9 allows attackers to execute arbitrary code via unspecified vectors. NOTE: the vendor has disputed this vulnerability, stating that it is "unexploitable.

This update of mailman fixes the following security issues :

  - A malicious user could visit a specially crafted URI and     inject an apparent log message into Mailman's error log     which might induce an unsuspecting administrator to     visit a phishing site. This has been blocked. Thanks to     Moritz Naumann for its discovery.

  - Fixed denial of service attack which can be caused by     some standards-breaking RFC 2231 formatted headers.
    CVE-2006-2941.

  - Several cross-site scripting issues have been fixed.
    Thanks to Moritz Naumann for their discovery.
    CVE-2006-3636

  - Fixed an unexploitable format string vulnerability.
    Discovery and fix by Karl Chen. Analysis of     non-exploitability by Martin 'Joey' Schulze. Also thanks     go to Lionel Elie Mamane. CVE-2006-2191.

This update of mailman fixes the following security issues :

  - A malicious user could visit a specially crafted URI and     inject an apparent log message into Mailman's error log     which might induce an unsuspecting administrator to     visit a phishing site. This has been blocked. Thanks to     Moritz Naumann for its discovery.

  - Fixed denial of service attack which can be caused by     some standards-breaking RFC 2231 formatted headers.
    CVE-2006-2941.

  - Several cross-site scripting issues have been fixed.
    Thanks to Moritz Naumann for their discovery.
    CVE-2006-3636: - Fixed an unexploitable format string     vulnerability. Discovery and fix by Karl Chen. Analysis     of non-exploitability by Martin 'Joey' Schulze. Also     thanks go to Lionel Elie Mamane. CVE-2006-2191.

Secunia reports :

Mailman can be exploited by malicious people to conduct cross-site scripting and phishing attacks, and cause a DoS (Denial of Service).

1) An error in the logging functionality can be exploited to inject a spoofed log message into the error log via a specially crafted URL.

Successful exploitation may trick an administrator into visiting a malicious website.

2) An error in the processing of malformed headers which does not follow the RFC 2231 standard can be exploited to cause a DoS (Denial of Service).

3) Some unspecified input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

ID	Name	Product	Family	Severity
41102	SuSE9 Security Update : mailman (YOU Patch Number 11243)	Nessus	SuSE Local Security Checks	high
29519	SuSE 10 Security Update : mailman (ZYPP Patch Number 2174)	Nessus	SuSE Local Security Checks	high
27344	openSUSE 10 Security Update : mailman (mailman-2170)	Nessus	SuSE Local Security Checks	high
22304	FreeBSD : mailman -- Multiple Vulnerabilities (fffa9257-3c17-11db-86ab-00123ffe8333)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2006-2191

critical

Tenable Plugins

high

high

high

high