Return-Path: owner-bugtraq@SECURITYFOCUS.COM Content-Type: application/pgp; format=text; x-action=sign X-Debian: PGP check passed for security officers Priority: urgent X-Mailing-List: archive/latest/106 X-Loop: debian-security-announce@lists.debian.org Precedence: list Message-ID: Date: Sun, 6 Aug 2000 05:26:19 -0700 Reply-To: security@debian.org Sender: Bugtraq List Comments: Resent-From: debian-security-announce@lists.debian.org Comments: Originally-From: joey@finlandia.Infodrom.North.DE (Martin Schulze) From: debian-security-announce@LISTS.DEBIAN.ORG Subject: [Security] Mailman exploitability To: BUGTRAQ@SECURITYFOCUS.COM -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---------------------------------------------------------------------------- Debian Security Advisory security@debian.org http://www.debian.org/security/ Martin Schulze August 5, 2000 - ---------------------------------------------------------------------------- Package: mailman Vulnerability: local mailman group exploit Debian-specific: no Former versions of mailman v2.0 came with a security problem, introduced during the 2.0 beta cycle, that could be exploited by clever local users to gain group mailman permission. No exploit does exist at the moment, though. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Debian GNU/Linux 2.1 alias slink - -------------------------------- Slink comes with version 1.0 that is not vulnerable. Debian 2.2 alias potato - ----------------------- Potato comes with version 1.1 that is not vulnerable. Debian Unstable alias woody - --------------------------- This version of Debian is not yet released and reflects the current development release. Fixes are currently available for Intel ia32 and Motorola 680x0. Fixes for other architectures will be available soon. In doubt, please recompile the package from source on your own. Source archives: ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5-1.diff.gz MD5 checksum: 177e666144c35d6b945b30dddf567fef ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5-1.dsc MD5 checksum: 431d66e4ef496ce48463ed55193d375c ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5.orig.tar.gz MD5 checksum: 2c2602b7745a56adecd4f24fdd6d446f Intel ia32 architecture: ftp://ftp.debian.org/debian/dists/woody/main/binary-i386/mail/mailman_2.0beta5-1.deb MD5 checksum: e2a071bf4a9a3be02978df47ed58acb6 Motorola 680x0 architecture: ftp://ftp.debian.org/debian/dists/woody/main/binary-m68k/mail/mailman_2.0beta5-1.deb MD5 checksum: 8bb6367c1e249beaaaa8eb3b7fc71c27 - ---------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable updates For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.1 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE5jVi0W5ql+IAeqTIRAntHAJ4qPqO9uLQirRFsl48T5Uv729A6/QCfUAiJ k+20YJsL9L3+SBCkm2KOxic= =7iAZ -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to debian-security-announce-request@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org