Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 51671 - net-mail/mailman 2.1.4 member password disclosure bug
Summary: net-mail/mailman 2.1.4 member password disclosure bug
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Highest critical (vote)
Assignee: Gentoo Security
Whiteboard: B3 [glsa]
: 52043 (view as bug list)
Depends on:
Reported: 2004-05-21 09:40 UTC by klavs klavsen
Modified: 2011-10-30 22:39 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---

new version fixing security issue (mailman-2.1.5.ebuild,3.07 KB, text/plain)
2004-05-29 02:52 UTC, FRLinux
no flags Details
mailman-2.1.5.ebuild (mailman-2.1.5.ebuild,3.68 KB, text/plain)
2004-05-31 02:48 UTC, Thierry Carrez (RETIRED)
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description klavs klavsen 2004-05-21 09:40:28 UTC
2.1.4 allows 3rd parties to obtain member passwords.
Also 2.1.5 has many performance enhancements.

Reproducible: Always
Steps to Reproduce:
Comment 1 klavs klavsen 2004-05-21 10:11:36 UTC
I tried just renaming the ebuild to 2.1.5 - and it compiles fine - and installs "almost"-fine..

I get this error:
    gunzip -c ./$p.tar.gz | (cd . ; tar xf -); \
    (cd ./$p ; umask 02 ; PYTHONPATH=/var/tmp/portage/mailman-2.1.5/image//usr/local/mailman/pythonlib /usr/bin/python --quiet install --install-lib /var/tmp/portage/mailman-2.1.5/image//usr/local/mailman/pythonlib --install-purelib /var/tmp/portage/mailman-2.1.5/image//usr/local/mailman/pythonlib --install-data /var/tmp/portage/mailman-2.1.5/image//usr/local/mailman/pythonlib); \
<command line>:1:15: missing terminating " character
<command line>:1:18: missing terminating " character
<command line>:1:18: missing terminating " character
<command line>:1:17: missing terminating " character
<command line>:1:20: missing terminating " character
error: command 'gcc' failed with exit status 1
<command line>:1:15: missing terminating " character
<command line>:1:18: missing terminating " character
<command line>:1:18: missing terminating " character
<command line>:1:17: missing terminating " character
<command line>:1:20: missing terminating " character
error: command 'gcc' failed with exit status 1
make[1]: *** [install-packages] Error 1
make[1]: Leaving directory `/var/tmp/portage/mailman-2.1.5/work/mailman-2.1.5/misc'

I don't remember if the same problem was in 2.1.4 - but 2.1.5 still seems to work just fine, anyways ( I probably just haven't found the place this breaks?).
I've tried to subscribe/unsubscribe to my newslist - haven't tried to send out yet.
Comment 2 Thierry Carrez (RETIRED) gentoo-dev 2004-05-21 11:57:20 UTC
Confirmed, from :

"This version also contains a fix for an exploit that could allow 3rd parties to retrieve member passwords."

net-mail : please bump mailman to 2.1.5
Comment 3 Martin Holzer (RETIRED) gentoo-dev 2004-05-25 23:56:36 UTC
*** Bug 52043 has been marked as a duplicate of this bug. ***
Comment 4 Thierry Carrez (RETIRED) gentoo-dev 2004-05-27 01:46:19 UTC
Martin: apparently you did a lot of maintenance work on this ebuild, could you bump it ? We had no feedback from the net-mail team...
Comment 5 FRLinux 2004-05-29 02:52:57 UTC
Created attachment 32239 [details]
new version fixing security issue

Modified the ebuild by : 

- fixing the apache2 entries
- made python-2.3.3 mandatory to compile on dependencies

Comment 6 Thierry Carrez (RETIRED) gentoo-dev 2004-05-29 03:42:10 UTC
Looking at the submitted ebuild, I think it drops Apache1 compatibility.

I checked a simple ebuild bump and it works perfectly... I don't have the problems Klavs described. I propose to put a bump ebuild as ~ for testing.
Comment 7 klavs klavsen 2004-05-30 01:02:08 UTC
It's probably my python version (2.2.3) then. Anyhow it works fine - except for the danish translation - which makes it barf - I have submitted a bugreport on that -with all info - incl. python version. 
Comment 8 Joshua J. Berry (CondorDes) (RETIRED) gentoo-dev 2004-05-30 15:53:34 UTC
Installs fine for me with the latest stable Python (2.3.3 I believe).
Comment 9 Thierry Carrez (RETIRED) gentoo-dev 2004-05-31 02:48:00 UTC
Created attachment 32372 [details]

OK so a bumped version is fine. We should probably change the Python DEPEND to
">=dev-lang/python-2.3" as this seems to be required for proper install.

Proposed ebuild is attached.

net-mail : we really need someone to bump this, and the security team will do
it by itself if you don't.
Comment 10 Thierry Carrez (RETIRED) gentoo-dev 2004-05-31 09:42:15 UTC
plasmaroo did the bump in portage, but without proper means to test, the ebuild has no KEYWORDS yet. We know it compiles and installs fine on x86, and had a somewhat positive usage report from the reporter.

Arches : please test and mark net-mail/mailman-2.1.5 ~ and/or stable.
We need at least "x86 ~ppc sparc" for the GLSA, which is already overdue.
Comment 11 Martin Holzer (RETIRED) gentoo-dev 2004-05-31 15:31:33 UTC
sorry for delay
just commited some correction to ebuild

mailman-2.1.5 works fine here
Comment 12 Jason Wever (RETIRED) gentoo-dev 2004-05-31 17:24:05 UTC
Martin, what MTA are you using with mailman?

I have a fresh install of mailman here with sendmail and any messages sent to the default mailman list get returned because the mailman script thinks it is getting run with a group of daemon instead of the prefered mail.  
Comment 13 Martin Holzer (RETIRED) gentoo-dev 2004-06-01 03:17:31 UTC
i'm using sendmail and have to override MAILGID="280" with MAILGID="2"
postfix need 65534 afaik
and smrsh need and other GID

how about qmail ?
Comment 14 Thierry Carrez (RETIRED) gentoo-dev 2004-06-01 05:08:32 UTC
x86, sparc : please test and mark stable the latest ebuild...
Comment 15 Jason Wever (RETIRED) gentoo-dev 2004-06-01 07:55:50 UTC
Stable on sparc.
Comment 16 Kurt Lieber (RETIRED) gentoo-dev 2004-06-03 07:12:56 UTC
Martin --

Is this OK to mark stable on x86?
Comment 17 Joshua J. Berry (CondorDes) (RETIRED) gentoo-dev 2004-06-08 12:33:47 UTC
This security bug is overdue.

x86 -- please test and mark stable ASAP.  Thanks.
Comment 18 Martin Holzer (RETIRED) gentoo-dev 2004-06-08 15:04:48 UTC
sorry for delay, x86 is now stable in cvs
Comment 19 Kurt Lieber (RETIRED) gentoo-dev 2004-06-09 02:56:47 UTC
glsa 200406-04
Comment 20 Tuan Van (RETIRED) gentoo-dev 2004-07-21 10:12:30 UTC
Comment 21 klavs klavsen 2004-07-21 23:00:13 UTC
Yes - Mailman 2.1.5 is the only one in the tree - and it is fixed in that.
It is already marked as "RESOLVED FIXED" though.