(Apple Issues Fix for OS X) Mailman Input Validation Hole in 'private.py' Discloses Files to Remote Users
|
|
SecurityTracker Alert ID: 1013501 |
|
SecurityTracker URL: http://securitytracker.com/id/1013501
|
|
CVE Reference:
CAN-2005-0202
(Links to External Site)
|
Date: Mar 22 2005
|
Impact:
Disclosure of authentication information, Disclosure of system information, Disclosure of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 2.1 - 2.1.5
|
Description:
An input validation vulnerability was reported in Mailman in 'private.py'. A remote user can access arbitrary files on the target system.
The true_path() function does not properly validate user-supplied input. A remote user that is a member of a private mailman list can submit a specially crafted input value to access files on the system, including the mailman configuration files and passwords.
A demonsration exploit may contain the following string:
"/...../"
Marcus Meissner reported this flaw.
|
Impact:
A remote user can access arbitrary files on the target system, including the mailman configuration files with user e-mail addresses and passwords.
|
Solution:
Apple has issued a fix as part of Apple Security Update 2005-003, described at:
http://docs.info.apple.com/article.html?artnum=301061
|
Vendor URL: mailman.sf.net/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
UNIX (OS X)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Mon, 21 Mar 2005 22:40:15 -0500
Subject: http://docs.info.apple.com/article.html?artnum=301061
|
Security Update 2005-003
* Mailman
Available for: Mac OS X Server v10.3.8
CVE-ID: CAN-2005-0202
Impact: Directory traversal issue in Mailman that could allow access to arbitrary
files.
Description: Mailman is a software package that provides mailing list management.
This update addresses an exposure in Mailman's private archive handling that allowed
remote access to arbitrary files on the system. Further information is available from
http://www.gnu.org/software/mailman/security.html.
|
|
