Bug 128058 – net-mail/mailman: susceptible to DoS attack if bad mime multipart message is encountered

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Jule Slootbeek 2006-03-29 18:36:19 UTC]

Mandriva Linux Security Advisory reports following security vulnerability. 
Possible Duplicate of bug 119313 or bug 112505. Please verify and advise.

-- MDKSA on Full-Disclosure mailinglist 2006/3/29 --

Mandriva Linux Security Advisory                         MDKSA-2006:061
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : mailman
 Date    : March 29, 2006
 Affected: 10.2, Corporate 3.0
 _______________________________________________________________________

 Problem Description:

 Scrubber.py, in Mailman 2.1.5 and earlier, when using email 2.5 (part
 of Python), is susceptible to a DoS (mailman service stops delivering
 for the list in question) if it encounters a badly formed mime
 multipart message with only one part and that part has two blank lines
 between the first boundary and the end boundary.

 Updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0052

[Comment 1 Jule Slootbeek 2006-03-29 18:45:55 UTC]

vulnerability applies to version 2.1.5 and below

[Comment 2 Stefan Cornelius (RETIRED) 2006-03-30 03:01:37 UTC]

we currently ship 2.1.7, thus unaffected