Ubuntu Security Notices
USN-345-1

USN-345-1: mailman vulnerabilities

Publication date

13 September 2006

Overview

mailman vulnerabilities

Releases

Details

Steve Alexander discovered that mailman did not properly handle
attachments with special filenames. A remote user could exploit that
to stop mail delivery until the server administrator manually cleaned
these posts. (CVE-2006-2941)

Various cross-site scripting vulnerabilities have been reported by
Barry Warsaw. By using specially crafted email addresses, names, and
similar arbitrary user-defined strings, a remote attacker could
exploit this to run web script code in the list administrator’s
web browser. (CVE-2006-3636)

URLs logged to the error log file are now checked for invalid
characters. Before, specially crafted URLs could inject arbitrary
messages into the log.

Update instructions

In general, a standard system upgrade is sufficient to effect the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
6.06 dapper	mailman – 2.1.5-9ubuntu4.1
5.10 breezy	mailman – 2.1.5-8ubuntu2.3
5.04 hoary	mailman – 2.1.5-7ubuntu0.3

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

USN-345-1: mailman vulnerabilities

Details

Update instructions

Reduce your security exposure

References