Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote attackers to hijack the authentication of administrators.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mailman: Missing CSRF protection in admin web interface (CVE-2016-7123)

  - Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before     2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an     option, as demonstrated by gaining access to the credentials of a victim's account. (CVE-2016-6893)

  - Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to     inject arbitrary web script or HTML via unspecified vectors. (CVE-2018-0618)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mailman: directory traversal in MTA transports that deliver programmatically (CVE-2015-2775)

  - mailman: Missing CSRF protection in admin web interface (CVE-2016-7123)

  - Pipermail in Mailman stores private mail messages with predictable filenames in a world-executable     directory, which allows local users to read private mailing list archives. (CVE-2002-0389)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3118-1 advisory.

    It was discovered that the Mailman administrative web interface did not protect against cross-site request     forgery (CSRF) attacks. If an authenticated user were tricked into visiting a malicious website while     logged into Mailman, a remote attacker could perform administrative actions. This issue only affected     Ubuntu 12.04 LTS. (CVE-2016-7123)

    Nishant Agarwala discovered that the Mailman user options page did not protect against cross-site request     forgery (CSRF) attacks. If an authenticated user were tricked into visiting a malicious website while     logged into Mailman, a remote attacker could modify user options. (CVE-2016-6893)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The late Tokio Kikuchi reported :

We may have to set lifetime for input forms because of recent activities on cross-site request forgery (CSRF). The form lifetime is successfully deployed in frameworks like web.py or plone etc. Proposed branch lp:~tkikuchi/mailman/form-lifetime implement lifetime in admin, admindb, options and edithtml interfaces. [...]

The web admin interface has been hardened against CSRF attacks by adding a hidden, encrypted token with a time stamp to form submissions and not accepting authentication by cookie if the token is missing, invalid or older than the new mm_cfg.py setting FORM_LIFETIME which defaults to one hour. Posthumous thanks go to Tokio Kikuchi for this implementation [...].

ID	Name	Product	Family	Severity
198394	RHEL 6 : mailman (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198363	RHEL 5 : mailman (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195540	RHEL 5 : mailman (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195510	RHEL 6 : mailman (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
94467	Ubuntu 14.04 LTS / 16.04 LTS : Mailman vulnerabilities (USN-3118-1)	Nessus	Ubuntu Local Security Checks	high
93361	FreeBSD : mailman -- CSRF hardening in parts of the web interface (9e50dcc3-740b-11e6-94a2-080027ef73ec)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-7123

high

Tenable Plugins

high

high

high

high

high

high