Jesse Keating
21/07/04, 09:55
=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated mailman resolves security vulnerability
Advisory ID: FLSA:1734
Issue date: 2004-07-19
Product: Red Hat Linux
Keywords: Bugfix
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1734
CVE Names: CAN-2004-0412
=2D -----------------------------------------------------------------------
=2D ---------------------------------------------------------------------
1. Topic:
Updated mailman packages that fixes a remote security vulnerability are now=
=20
available.
2. Relevent releases/architectures:
Red Hat Linux 9 - i386
3. Problem description:
Mailman is software to help manage email discussion lists, much like=20
Majordomo and Smartmail. Unlike most similar products, Mailman gives each=20
mailing list a webpage, and allows users to subscribe, unsubscribe, etc.=20
over the Web. Even the list manager can administer his or her list=20
entirely from the Web. Mailman also integrates most things people want to=20
do with mailing lists, including archiving, mail <-> news gateways, and so=
=20
on.
A flaw in Mailman 2.1.* allows a remote attacker to retrieve the mailman=20
password of any subscriber by sending a carefully crafted email request to=
=20
the mailman server.
A simple patch is available and is fixed upstream in Mailman 2.1.5.
All users are advised to upgrade to these updated packages, which contain a=
=20
backported fix and are not vulnerable to this issue.
=46edora Legacy would like to thank Marc Deslauriers for reporting this=20
issue.
4. Solution:
Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which are=20
not installed but included in the list will not be updated. Note that you=
=20
can also use wildcards (*.rpm) if your current directory *only* contains=20
the desired RPMs.
Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate=
=20
RPMs being upgraded on your system. This assumes that you have yum or=20
apt-get configured for obtaining Fedora Legacy content. Please visit=20
http://www fedoralegacy.org/docs for directions on how to configure yum=20
and apt-get.
5. Bug IDs fixed:
http://bugzilla.fedora.us - 1734 - CAN-2004-0412 Mailman password retrieval
6. RPMs required:
Red Hat Linux 9:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/mailman-2.1.1-7.l=
egacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mailman-2.1.1-7.le=
gacy.i386.rpm
7. Verification:
SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---
4dee398d2d9b1d107850665f04c082073b4465a5 =20
9/updates/SRPMS/mailman-2.1.1-7.legacy.src.rpm
66cbbfcf168869969b0aaa0298d3680c3b8e5a3c =20
9/updates/i386/mailman-2.1.1-7.legacy.i386.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2004-0412
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=3D123559
http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at http://www.fedoralegacy.org
=2D ---------------------------------------------------------------------
=2D --=20
Jesse Keating RHCE (http://geek.j2solutions.net)
=46edora Legacy Team (http://www.fedoralegacy.org)
GPG Public Key (http://geek.j2solutions.net/jkeating.j2solutions.pub)
Was I helpful? Let others know:
http://svcs.affero.net/rm.php?r=3Djkeating
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFA/KA94v2HLvE71NURAt/3AJ942eiZGscchS/7odKEbHIBdHiTkQCdFZ7A
lw5W/vaFcRxviBD3grWB6bs=3D
=3DdSXw
=2D----END PGP SIGNATURE-----
Hash: SHA1
=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated mailman resolves security vulnerability
Advisory ID: FLSA:1734
Issue date: 2004-07-19
Product: Red Hat Linux
Keywords: Bugfix
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1734
CVE Names: CAN-2004-0412
=2D -----------------------------------------------------------------------
=2D ---------------------------------------------------------------------
1. Topic:
Updated mailman packages that fixes a remote security vulnerability are now=
=20
available.
2. Relevent releases/architectures:
Red Hat Linux 9 - i386
3. Problem description:
Mailman is software to help manage email discussion lists, much like=20
Majordomo and Smartmail. Unlike most similar products, Mailman gives each=20
mailing list a webpage, and allows users to subscribe, unsubscribe, etc.=20
over the Web. Even the list manager can administer his or her list=20
entirely from the Web. Mailman also integrates most things people want to=20
do with mailing lists, including archiving, mail <-> news gateways, and so=
=20
on.
A flaw in Mailman 2.1.* allows a remote attacker to retrieve the mailman=20
password of any subscriber by sending a carefully crafted email request to=
=20
the mailman server.
A simple patch is available and is fixed upstream in Mailman 2.1.5.
All users are advised to upgrade to these updated packages, which contain a=
=20
backported fix and are not vulnerable to this issue.
=46edora Legacy would like to thank Marc Deslauriers for reporting this=20
issue.
4. Solution:
Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which are=20
not installed but included in the list will not be updated. Note that you=
=20
can also use wildcards (*.rpm) if your current directory *only* contains=20
the desired RPMs.
Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate=
=20
RPMs being upgraded on your system. This assumes that you have yum or=20
apt-get configured for obtaining Fedora Legacy content. Please visit=20
http://www fedoralegacy.org/docs for directions on how to configure yum=20
and apt-get.
5. Bug IDs fixed:
http://bugzilla.fedora.us - 1734 - CAN-2004-0412 Mailman password retrieval
6. RPMs required:
Red Hat Linux 9:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/mailman-2.1.1-7.l=
egacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mailman-2.1.1-7.le=
gacy.i386.rpm
7. Verification:
SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---
4dee398d2d9b1d107850665f04c082073b4465a5 =20
9/updates/SRPMS/mailman-2.1.1-7.legacy.src.rpm
66cbbfcf168869969b0aaa0298d3680c3b8e5a3c =20
9/updates/i386/mailman-2.1.1-7.legacy.i386.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2004-0412
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=3D123559
http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at http://www.fedoralegacy.org
=2D ---------------------------------------------------------------------
=2D --=20
Jesse Keating RHCE (http://geek.j2solutions.net)
=46edora Legacy Team (http://www.fedoralegacy.org)
GPG Public Key (http://geek.j2solutions.net/jkeating.j2solutions.pub)
Was I helpful? Let others know:
http://svcs.affero.net/rm.php?r=3Djkeating
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFA/KA94v2HLvE71NURAt/3AJ942eiZGscchS/7odKEbHIBdHiTkQCdFZ7A
lw5W/vaFcRxviBD3grWB6bs=3D
=3DdSXw
=2D----END PGP SIGNATURE-----