Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

From Red Hat Security Advisory 2006:0600 :

Updated mailman packages that fix security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mailman is a program used to help manage email discussion lists.

A flaw was found in the way Mailman handled MIME multipart messages.
An attacker could send a carefully crafted MIME multipart email message to a mailing list run by Mailman which caused that particular mailing list to stop working. (CVE-2006-2941)

Several cross-site scripting (XSS) issues were found in Mailman. An attacker could exploit these issues to perform cross-site scripting attacks against the Mailman administrator. (CVE-2006-3636)

Red Hat would like to thank Barry Warsaw for disclosing these vulnerabilities.

Users of Mailman should upgrade to these updated packages, which contain backported patches to correct this issue.

This update of mailman fixes the following security issues :

  - A malicious user could visit a specially crafted URI and     inject an apparent log message into Mailman's error log     which might induce an unsuspecting administrator to     visit a phishing site. This has been blocked. Thanks to     Moritz Naumann for its discovery.

  - Fixed denial of service attack which can be caused by     some standards-breaking RFC 2231 formatted headers.
    CVE-2006-2941.

  - Several cross-site scripting issues have been fixed.
    Thanks to Moritz Naumann for their discovery.
    CVE-2006-3636

  - Fixed an unexploitable format string vulnerability.
    Discovery and fix by Karl Chen. Analysis of     non-exploitability by Martin 'Joey' Schulze. Also thanks     go to Lionel Elie Mamane. CVE-2006-2191.

This update of mailman fixes the following security issues :

  - A malicious user could visit a specially crafted URI and     inject an apparent log message into Mailman's error log     which might induce an unsuspecting administrator to     visit a phishing site. This has been blocked. Thanks to     Moritz Naumann for its discovery.

  - Fixed denial of service attack which can be caused by     some standards-breaking RFC 2231 formatted headers.
    CVE-2006-2941.

  - Several cross-site scripting issues have been fixed.
    Thanks to Moritz Naumann for their discovery.
    CVE-2006-3636: - Fixed an unexploitable format string     vulnerability. Discovery and fix by Karl Chen. Analysis     of non-exploitability by Martin 'Joey' Schulze. Also     thanks go to Lionel Elie Mamane. CVE-2006-2191.

Steve Alexander discovered that mailman did not properly handle attachments with special filenames. A remote user could exploit that to stop mail delivery until the server administrator manually cleaned these posts. (CVE-2006-2941)

Various cross-site scripting vulnerabilities have been reported by Barry Warsaw. By using specially crafted email addresses, names, and similar arbitrary user-defined strings, a remote attacker could exploit this to run web script code in the list administrator's web browser. (CVE-2006-3636)

URLs logged to the error log file are now checked for invalid characters. Before, specially crafted URLs could inject arbitrary messages into the log.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was discovered in how Mailman handles MIME multipart messages where an attacker could send a carefully-crafted MIME multipart message to a Mailman-run mailing list causing that mailing list to stop working (CVE-2006-2941).

As well, a number of XSS (cross-site scripting) issues were discovered that could be exploited to perform XSS attacks against the Mailman administrator (CVE-2006-3636).

Finally, a CRLF injection vulnerability allows remote attackers to spoof messages in the error log (CVE-2006-4624).

Updated packages have been patched to address these issues.

Several security related problems have been discovered in mailman, the web-based GNU mailing list manager. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-3636     Moritz Naumann discovered several cross-site scripting     problems that could allow remote attackers to inject     arbitrary web script code or HTML.

  - CVE-2006-4624     Moritz Naumann discovered that a remote attacker can     inject arbitrary strings into the logfile.

Updated mailman packages that fix security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mailman is a program used to help manage email discussion lists.

A flaw was found in the way Mailman handled MIME multipart messages.
An attacker could send a carefully crafted MIME multipart email message to a mailing list run by Mailman which caused that particular mailing list to stop working. (CVE-2006-2941)

Several cross-site scripting (XSS) issues were found in Mailman. An attacker could exploit these issues to perform cross-site scripting attacks against the Mailman administrator. (CVE-2006-3636)

Red Hat would like to thank Barry Warsaw for disclosing these vulnerabilities.

Users of Mailman should upgrade to these updated packages, which contain backported patches to correct this issue.

The version of Mailman installed on the remote host fails to sanitize user-supplied input before writing it to the application's 'error' log.  An unauthenticated remote attacker can leverage this flaw to spoof log messages.  In addition, the application is reportedly affected by a denial of service issue involving headers that do not conform to RFC 2231 as well as several cross-site scripting vulnerabilities.

Secunia reports :

Mailman can be exploited by malicious people to conduct cross-site scripting and phishing attacks, and cause a DoS (Denial of Service).

1) An error in the logging functionality can be exploited to inject a spoofed log message into the error log via a specially crafted URL.

Successful exploitation may trick an administrator into visiting a malicious website.

2) An error in the processing of malformed headers which does not follow the RFC 2231 standard can be exploited to cause a DoS (Denial of Service).

3) Some unspecified input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

ID	Name	Product	Family	Severity
67397	Oracle Linux 3 / 4 : mailman (ELSA-2006-0600)	Nessus	Oracle Linux Local Security Checks	medium
41102	SuSE9 Security Update : mailman (YOU Patch Number 11243)	Nessus	SuSE Local Security Checks	high
29519	SuSE 10 Security Update : mailman (ZYPP Patch Number 2174)	Nessus	SuSE Local Security Checks	high
27924	Ubuntu 5.04 / 5.10 / 6.06 LTS : mailman vulnerabilities (USN-345-1)	Nessus	Ubuntu Local Security Checks	medium
27344	openSUSE 10 Security Update : mailman (mailman-2170)	Nessus	SuSE Local Security Checks	high
23909	Mandrake Linux Security Advisory : mailman (MDKSA-2006:165)	Nessus	Mandriva Local Security Checks	medium
22730	Debian DSA-1188-1 : mailman - format string	Nessus	Debian Local Security Checks	medium
22330	RHEL 3 / 4 : mailman (RHSA-2006:0600)	Nessus	Red Hat Local Security Checks	medium
22320	CentOS 3 / 4 : mailman (CESA-2006:0600)	Nessus	CentOS Local Security Checks	medium
3737	Mailman < 2.1.9rc1 Spoofed Log Entry Injection	Nessus Network Monitor	CGI	medium
22304	FreeBSD : mailman -- Multiple Vulnerabilities (fffa9257-3c17-11db-86ab-00123ffe8333)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2006-3636

medium

Tenable Plugins

medium

high

high

medium

high

medium

medium

medium

medium

medium

high