Detections
Analytics
Debian DSA-1188-1 : mailman - format string
medium Nessus Plugin ID 22730
Synopsis
The remote Debian host is missing a security-related update.Description
Several security related problems have been discovered in mailman, the web-based GNU mailing list manager. The Common Vulnerabilities and Exposures project identifies the following problems :- CVE-2006-3636 Moritz Naumann discovered several cross-site scripting problems that could allow remote attackers to inject arbitrary web script code or HTML.
- CVE-2006-4624 Moritz Naumann discovered that a remote attacker can inject arbitrary strings into the logfile.
Solution
Upgrade the mailman package.For the stable distribution (sarge) these problems have been fixed in version 2.1.5-8sarge5.
See Also
https://security-tracker.debian.org/tracker/CVE-2006-3636
Plugin Details
Severity: Medium
ID: 22730
File Name: debian_DSA-1188.nasl
Version: 1.20
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 10/14/2006
Updated: 1/4/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.5
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:mailman, cpe:/o:debian:debian_linux:3.1
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/4/2006
Vulnerability Publication Date: 9/2/2006
Reference Information
CVE: CVE-2006-3636, CVE-2006-4624
BID: 19831
CWE: 94
DSA: 1188