Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) the list information field or (2) the list description field.

mailman was updates to version 2.1.14 to fix several cross-site-scripting (XSS) vulnerabilities (CVE-2011-0707, CVE-2010-3089).

From Red Hat Security Advisory 2011:0308 :

An updated mailman package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mailman is a program used to help manage email discussion lists.

Multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of those pages, they could perform a cross-site scripting (XSS) attack against the victim. (CVE-2011-0707)

Multiple input sanitization flaws were found in the way Mailman displayed mailing list information. A mailing list administrator could use this flaw to conduct a cross-site scripting (XSS) attack against victims viewing a list's 'listinfo' page. (CVE-2010-3089)

Red Hat would like to thank Mark Sapiro for reporting these issues.

Users of mailman should upgrade to this updated package, which contains backported patches to correct these issues.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2011-0307 advisory.

    [3:2.1.9-6.1]
    - fix #677845 - fixed CVE-2008-0564, CVE-2010-3089 and CVE-2011-0707

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of those pages, they could perform a cross-site scripting (XSS) attack against the victim. (CVE-2011-0707)

Multiple input sanitization flaws were found in the way Mailman displayed mailing list information. A mailing list administrator could use this flaw to conduct a cross-site scripting (XSS) attack against victims viewing a list's 'listinfo' page. (CVE-2010-3089)

Multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of those pages, they could perform a cross-site scripting (XSS) attack against the victim. (CVE-2011-0707)

Multiple input sanitization flaws were found in the way Mailman displayed mailing list information. A mailing list administrator could use this flaw to conduct a cross-site scripting (XSS) attack against victims viewing a list's 'listinfo' page. (CVE-2008-0564, CVE-2010-3089)

This mailman update fixes several cross-site scripting (XSS) vulnerabilities. (CVE-2011-0707 / CVE-2010-3089)

According to its self-reported version number, the Mailman installation running on the remote host has multiple cross-site scripting vulnerabilities.  These vulnerabilities can reportedly only be exploited by a list owner.

A malicious list owner could exploit these issues to execute arbitrary script code in another user's browser.

mailman was updated to version 2.1.14 to fix several cross-site-scripting (XSS) vulnerabilities (CVE-2011-0707, CVE-2010-3089, CVE-2010-3090).

mailman was updated to version 2.1.14 to fix several cross-site scripting (XSS) vulnerabilities. (CVE-2011-0707 / CVE-2010-3089 / CVE-2010-3090)

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.7.

Mac OS X 10.6.7 contains security fixes for the following products :

  - AirPort
  - Apache
  - AppleScript
  - ATS
  - bzip2
  - CarbonCore
  - ClamAV
  - CoreText
  - File Quarantine
  - HFS
  - ImageIO
  - Image RAW
  - Installer
  - Kerberos
  - Kernel
  - Libinfo
  - libxml
  - Mailman
  - PHP
  - QuickLook
  - QuickTime
  - Ruby
  - Samba
  - Subversion
  - Terminal
  - X11

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2011-001 applied. 

This security update contains fixes for the following products :

  - Apache
  - bzip2
  - ClamAV
  - ImageIO
  - Kerberos
  - Libinfo
  - libxml
  - Mailman
  - PHP
  - QuickLook
  - Ruby
  - X11

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11
IAVB Reference : 2010-B-0083
STIG Finding Severity : Category II

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11

An updated mailman package that fixes multiple security issues is now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mailman is a program used to help manage email discussion lists.

Multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of those pages, they could perform a cross-site scripting (XSS) attack against the victim. (CVE-2011-0707)

Multiple input sanitization flaws were found in the way Mailman displayed mailing list information. A mailing list administrator could use this flaw to conduct a cross-site scripting (XSS) attack against victims viewing a list's 'listinfo' page. (CVE-2008-0564, CVE-2010-3089)

Red Hat would like to thank Mark Sapiro for reporting the CVE-2011-0707 and CVE-2010-3089 issues.

Users of mailman should upgrade to this updated package, which contains backported patches to correct these issues.

An updated mailman package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mailman is a program used to help manage email discussion lists.

Multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of those pages, they could perform a cross-site scripting (XSS) attack against the victim. (CVE-2011-0707)

Multiple input sanitization flaws were found in the way Mailman displayed mailing list information. A mailing list administrator could use this flaw to conduct a cross-site scripting (XSS) attack against victims viewing a list's 'listinfo' page. (CVE-2010-3089)

Red Hat would like to thank Mark Sapiro for reporting these issues.

Users of mailman should upgrade to this updated package, which contains backported patches to correct these issues.

The remote Redhat Enterprise Linux 4 / 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2011:0307 advisory.

  - mailman: XSS triggerable by list administrator (CVE-2008-0564)

  - mailman: Multiple security flaws leading to cross-site scripting (XSS) attacks (CVE-2010-3089)

  - Mailman: Three XSS flaws due improper escaping of the full name of the member (CVE-2011-0707)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that Mailman did not properly sanitize certain fields, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two cross site scripting vulnerabilities were been discovered in Mailman, a web-based mailing list manager. These allowed an attacker to retrieve session cookies via inserting crafted JavaScript into confirmation messages (CVE-2011-0707 ) and in the list admin interface (CVE-2010-3089; oldstable only).

Fix of CVE-2010-3089 Mailman: Multiple security flaws leading to cross-site scripting (XSS) attacks

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix of CVE-2010-3089 Mailman: Multiple security flaws leading to cross-site scripting (XSS) attacks and rebuild to fix gcc bug.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Secunia reports :

Two vulnerabilities have been reported in Mailman, which can be exploited by malicious users to conduct script insertion attacks.

Certain input passed via the list descriptions is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation requires 'list owner' permissions.

Multiple vulnerabilities has been found and corrected in mailman :

Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) the list information field or (2) the list description field (CVE-2010-3089).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

ID	Name	Product	Family	Severity
75641	openSUSE Security Update : mailman (openSUSE-SU-2011:0312-1)	Nessus	SuSE Local Security Checks	medium
68211	Oracle Linux 6 : mailman (ELSA-2011-0308)	Nessus	Oracle Linux Local Security Checks	medium
68210	Oracle Linux 5 : mailman (ELSA-2011-0307)	Nessus	Oracle Linux Local Security Checks	medium
60969	Scientific Linux Security Update : mailman on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60968	Scientific Linux Security Update : mailman on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57225	SuSE 10 Security Update : mailman (ZYPP Patch Number 7484)	Nessus	SuSE Local Security Checks	medium
54579	Mailman < 2.1.14 Multiple XSS	Nessus	CGI abuses : XSS	low
53768	openSUSE Security Update : mailman (openSUSE-SU-2011:0424-1)	Nessus	SuSE Local Security Checks	medium
53639	SuSE 10 Security Update : mailman (ZYPP Patch Number 7489)	Nessus	SuSE Local Security Checks	medium
53619	SuSE 11.1 Security Update : mailman (SAT Patch Number 4433)	Nessus	SuSE Local Security Checks	medium
52754	Mac OS X 10.6.x < 10.6.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
52753	Mac OS X Multiple Vulnerabilities (Security Update 2011-001)	Nessus	MacOS X Local Security Checks	high
800796	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5826	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
52506	CentOS 4 / 5 : mailman (CESA-2011:0307)	Nessus	CentOS Local Security Checks	medium
52492	RHEL 6 : mailman (RHSA-2011:0308)	Nessus	Red Hat Local Security Checks	medium
52491	RHEL 4 / 5 : mailman (RHSA-2011:0307)	Nessus	Red Hat Local Security Checks	medium
52070	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : mailman vulnerabilities (USN-1069-1)	Nessus	Ubuntu Local Security Checks	medium
52037	Debian DSA-2170-1 : mailman - several vulnerabilities	Nessus	Debian Local Security Checks	medium
51345	Fedora 13 : mailman-2.1.12-16.fc13 (2010-14877)	Nessus	Fedora Local Security Checks	low
51344	Fedora 14 : mailman-2.1.13-6.fc14.1 (2010-14834)	Nessus	Fedora Local Security Checks	low
50469	FreeBSD : Mailman -- XSS in web interface (4ab29e12-e787-11df-adfa-00e0815b8da8)	Nessus	FreeBSD Local Security Checks	low
49738	Mandriva Linux Security Advisory : mailman (MDVSA-2010:191)	Nessus	Mandriva Local Security Checks	low

Detections

Analytics

CVE-2010-3089

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

low

medium

medium

medium

high

high

high

critical

medium

medium

medium

medium

medium

low

low

low

low