Gentoo Bug 119313 - net-mail/mailman-2.1.6 - remote DoS (CVE-2005-4153)

Description:

Opened: 2006-01-17 10:42 0000

Mailman 2.1.4 through 2.1.6 allows remote attackers to cause a denial of
service via a message that causes the server to "fail with an Overflow on bad
date data in a processed message," a different vulnerability than
CVE-2005-3573.

------- Comment #1 From Sune Kloppenborg Jeppesen 2006-01-17 11:52:42 0000 -------

net-mail please advise.

------- Comment #2 From Thierry Carrez (RETIRED) 2006-01-18 06:47:22 0000 -------

Can't tell if 2.1.7 includes the fix for this one... but in all cases looks
like a good security bump.

2.1.7 (31-Dec-2005)

  Security

    - The fix for CAN-2005-0202 has been enhanced to issue an appropriate
      message instead of just quietly dropping ./ and ../ from URLs.

    - A note on CVE-2005-3573: Although the RFC2231 bug example in the CVE has
      been solved in Mailman 2.1.6, there may be more cases where
      ToDigest.send_digests() can block regular delivery.  We put the
      send_digests() calling part in a try/except clause and leave a message
      in the error log if something happened in send_digests().  Daily call of
      cron/senddigests will provide more detail to the site administrator.

    - List administrators can no longer change the user's option/subscription
      globally.  Site admin can change these only if
      mm_cfg.ALLOW_SITE_ADMIN_COOKIES is set to Yes.

    - Script tags are HTML-escaped in the edithtml CGI script.

    - Since the probe message for disabled users may reach unintended
      recipients, the password is excluded from sendProbe() and probe.txt.
      Note that the default value of VERP_PROBE has been set to `No' from
      2.1.6., thus this change doesn't affect the default behavior.

------- Comment #3 From Sune Kloppenborg Jeppesen 2006-02-06 12:23:46 0000 -------

net-mail please provide an updated ebuild.

------- Comment #4 From Tuan Van (RETIRED) 2006-02-06 16:20:50 0000 -------

sorry for the late reply because mailman has been maintained by mholzer lately.
We are waiting for hos response. Anyway, mailman-2.1.17 has been in the tree
for quite some time.

*mailman-2.1.7 (03 Jan 2006)

  03 Jan 2006; Martin Holzer <mholzer@gentoo.org>
  +files/mailman-2.1.7-directory-check.patch, +mailman-2.1.7.ebuild:
  Version bumped.

best regards,
Tuan Van

------- Comment #5 From Sune Kloppenborg Jeppesen 2006-02-06 22:54:22 0000 -------

Langthang sorry for not checking.

Arches please test and mark stable.

------- Comment #6 From Simon Stelling (RETIRED) 2006-02-07 05:02:08 0000 -------

amd64 stable

------- Comment #7 From Chris Gianelloni (RETIRED) 2006-02-08 13:55:46 0000 -------

x86 is done...

------- Comment #8 From Jason Wever (RETIRED) 2006-02-12 20:12:06 0000 -------

SPARC'd

------- Comment #9 From Thierry Carrez (RETIRED) 2006-02-13 10:20:38 0000 -------

Ready for glsa vote

------- Comment #10 From Thierry Carrez (RETIRED) 2006-02-16 12:57:20 0000 -------

Without more I tend to say no.

------- Comment #11 From Stefan Cornelius (RETIRED) 2006-02-23 12:05:02 0000 -------

1/2 no from me, too. Make it a full no if needed.

------- Comment #12 From Thierry Carrez (RETIRED) 2006-02-26 03:42:41 0000 -------

Closing.
Feel free to reopen if you intended to vote yes.

Bug 119313 depends on:			Show dependency tree
Bug 119313 blocks:			Show dependency tree

Bugzilla Bug 119313

net-mail/mailman-2.1.6 - remote DoS (CVE-2005-4153)

Last modified: 2006-02-26 03:42:41 0000