Detections
Analytics

Debian DSA-147-1 : mailman - XSS

high Nessus Plugin ID 14984

Synopsis

The remote Debian host is missing a security-related update.

Description

A cross-site scripting vulnerability was discovered in mailman, a software to manage electronic mailing lists. When a properly crafted URL is accessed with Internet Explorer (other browsers don't seem to be affected), the resulting webpage is rendered similar to the real one, but the JavaScript component is executed as well, which could be used by an attacker to get access to sensitive information. The new version for Debian 2.2 also includes backports of security related patches from mailman 2.0.11.

Solution

Upgrade the mailman package.

This problem has been fixed in version 2.0.11-1woody4 for the current stable distribution (woody), in version 1.1-10.1 for the old stable distribution (potato) and in version 2.0.12-1 for the unstable distribution (sid).

See Also

http://www.debian.org/security/2002/dsa-147

Plugin Details

Severity: High

ID: 14984

File Name: debian_DSA-147.nasl

Version: 1.21

Type: local

Agent: unix

Published: 9/29/2004

Updated: 1/4/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:2.2, p-cpe:/a:debian:debian_linux:mailman, cpe:/o:debian:debian_linux:3.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 8/8/2002

Reference Information

CVE: CVE-2002-0388, CVE-2002-0855

BID: 4825, 4826, 5298

DSA: 147