Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.

mailman was updates to version 2.1.14 to fix several cross-site-scripting (XSS) vulnerabilities (CVE-2011-0707, CVE-2010-3089).

From Red Hat Security Advisory 2011:0308 :

An updated mailman package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mailman is a program used to help manage email discussion lists.

Multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of those pages, they could perform a cross-site scripting (XSS) attack against the victim. (CVE-2011-0707)

Multiple input sanitization flaws were found in the way Mailman displayed mailing list information. A mailing list administrator could use this flaw to conduct a cross-site scripting (XSS) attack against victims viewing a list's 'listinfo' page. (CVE-2010-3089)

Red Hat would like to thank Mark Sapiro for reporting these issues.

Users of mailman should upgrade to this updated package, which contains backported patches to correct these issues.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2011-0307 advisory.

    [3:2.1.9-6.1]
    - fix #677845 - fixed CVE-2008-0564, CVE-2010-3089 and CVE-2011-0707

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of those pages, they could perform a cross-site scripting (XSS) attack against the victim. (CVE-2011-0707)

Multiple input sanitization flaws were found in the way Mailman displayed mailing list information. A mailing list administrator could use this flaw to conduct a cross-site scripting (XSS) attack against victims viewing a list's 'listinfo' page. (CVE-2010-3089)

Multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of those pages, they could perform a cross-site scripting (XSS) attack against the victim. (CVE-2011-0707)

Multiple input sanitization flaws were found in the way Mailman displayed mailing list information. A mailing list administrator could use this flaw to conduct a cross-site scripting (XSS) attack against victims viewing a list's 'listinfo' page. (CVE-2008-0564, CVE-2010-3089)

This mailman update fixes several cross-site scripting (XSS) vulnerabilities. (CVE-2011-0707 / CVE-2010-3089)

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2011-006 applied.  This update contains numerous security-related fixes for the following components :

  - Apache
  - Application Firewall
  - ATS
  - BIND
  - Certificate Trust Policy
  - CFNetwork
  - CoreFoundation
  - CoreMedia
  - File Systems
  - IOGraphics
  - iChat Server
  - Mailman
  - MediaKit
  - PHP
  - postfix
  - python
  - QuickTime
  - Tomcat
  - User Documentation
  - Web Server
  - X11

mailman was updated to version 2.1.14 to fix several cross-site-scripting (XSS) vulnerabilities (CVE-2011-0707, CVE-2010-3089, CVE-2010-3090).

mailman was updated to version 2.1.14 to fix several cross-site scripting (XSS) vulnerabilities. (CVE-2011-0707 / CVE-2010-3089 / CVE-2010-3090)

fixed CVE-2011-0707: three XSS flaws due improper escaping of the full name of the member

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE reports :

Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.

An updated mailman package that fixes multiple security issues is now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mailman is a program used to help manage email discussion lists.

Multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of those pages, they could perform a cross-site scripting (XSS) attack against the victim. (CVE-2011-0707)

Multiple input sanitization flaws were found in the way Mailman displayed mailing list information. A mailing list administrator could use this flaw to conduct a cross-site scripting (XSS) attack against victims viewing a list's 'listinfo' page. (CVE-2008-0564, CVE-2010-3089)

Red Hat would like to thank Mark Sapiro for reporting the CVE-2011-0707 and CVE-2010-3089 issues.

Users of mailman should upgrade to this updated package, which contains backported patches to correct these issues.

An updated mailman package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mailman is a program used to help manage email discussion lists.

Multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of those pages, they could perform a cross-site scripting (XSS) attack against the victim. (CVE-2011-0707)

Multiple input sanitization flaws were found in the way Mailman displayed mailing list information. A mailing list administrator could use this flaw to conduct a cross-site scripting (XSS) attack against victims viewing a list's 'listinfo' page. (CVE-2010-3089)

Red Hat would like to thank Mark Sapiro for reporting these issues.

Users of mailman should upgrade to this updated package, which contains backported patches to correct these issues.

The remote Redhat Enterprise Linux 4 / 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2011:0307 advisory.

  - mailman: XSS triggerable by list administrator (CVE-2008-0564)

  - mailman: Multiple security flaws leading to cross-site scripting (XSS) attacks (CVE-2010-3089)

  - Mailman: Three XSS flaws due improper escaping of the full name of the member (CVE-2011-0707)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A vulnerability has been found and corrected in mailman :

Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message (CVE-2011-0707).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

It was discovered that Mailman did not properly sanitize certain fields, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two cross site scripting vulnerabilities were been discovered in Mailman, a web-based mailing list manager. These allowed an attacker to retrieve session cookies via inserting crafted JavaScript into confirmation messages (CVE-2011-0707 ) and in the list admin interface (CVE-2010-3089; oldstable only).

ID	Name	Product	Family	Severity
75641	openSUSE Security Update : mailman (openSUSE-SU-2011:0312-1)	Nessus	SuSE Local Security Checks	medium
68211	Oracle Linux 6 : mailman (ELSA-2011-0308)	Nessus	Oracle Linux Local Security Checks	medium
68210	Oracle Linux 5 : mailman (ELSA-2011-0307)	Nessus	Oracle Linux Local Security Checks	medium
60969	Scientific Linux Security Update : mailman on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60968	Scientific Linux Security Update : mailman on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57225	SuSE 10 Security Update : mailman (ZYPP Patch Number 7484)	Nessus	SuSE Local Security Checks	medium
56481	Mac OS X Multiple Vulnerabilities (Security Update 2011-006)	Nessus	MacOS X Local Security Checks	critical
53768	openSUSE Security Update : mailman (openSUSE-SU-2011:0424-1)	Nessus	SuSE Local Security Checks	medium
53639	SuSE 10 Security Update : mailman (ZYPP Patch Number 7489)	Nessus	SuSE Local Security Checks	medium
53619	SuSE 11.1 Security Update : mailman (SAT Patch Number 4433)	Nessus	SuSE Local Security Checks	medium
52744	Fedora 13 : mailman-2.1.12-17.fc13 (2011-2125)	Nessus	Fedora Local Security Checks	medium
52743	Fedora 14 : mailman-2.1.13-7.fc14 (2011-2102)	Nessus	Fedora Local Security Checks	medium
52742	Fedora 15 : mailman-2.1.14-5.fc15 (2011-2030)	Nessus	Fedora Local Security Checks	medium
52626	FreeBSD : mailman -- XSS vulnerability (64691c49-4b22-11e0-a226-00e0815b8da8)	Nessus	FreeBSD Local Security Checks	medium
52506	CentOS 4 / 5 : mailman (CESA-2011:0307)	Nessus	CentOS Local Security Checks	medium
52492	RHEL 6 : mailman (RHSA-2011:0308)	Nessus	Red Hat Local Security Checks	medium
52491	RHEL 4 / 5 : mailman (RHSA-2011:0307)	Nessus	Red Hat Local Security Checks	medium
52160	Mandriva Linux Security Advisory : mailman (MDVSA-2011:036)	Nessus	Mandriva Local Security Checks	medium
52070	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : mailman vulnerabilities (USN-1069-1)	Nessus	Ubuntu Local Security Checks	medium
52037	Debian DSA-2170-1 : mailman - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2011-0707

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium