=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory

Synopsis: Updated mailman resolves security vulnerability
Advisory ID: FLSA:1734
Issue date: 2004-07-19
Product: Red Hat Linux
Keywords: Bugfix
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1734
CVE Names: CAN-2004-0412
=2D -----------------------------------------------------------------------


=2D ---------------------------------------------------------------------
1. Topic:

Updated mailman packages that fixes a remote security vulnerability are now=
=20
available.

2. Relevent releases/architectures:

Red Hat Linux 9 - i386

3. Problem description:

Mailman is software to help manage email discussion lists, much like=20
Majordomo and Smartmail. Unlike most similar products, Mailman gives each=20
mailing list a webpage, and allows users to subscribe, unsubscribe, etc.=20
over the Web. Even the list manager can administer his or her list=20
entirely from the Web. Mailman also integrates most things people want to=20
do with mailing lists, including archiving, mail <-> news gateways, and so=
=20
on.

A flaw in Mailman 2.1.* allows a remote attacker to retrieve the mailman=20
password of any subscriber by sending a carefully crafted email request to=
=20
the mailman server.

A simple patch is available and is fixed upstream in Mailman 2.1.5.

All users are advised to upgrade to these updated packages, which contain a=
=20
backported fix and are not vulnerable to this issue.

=46edora Legacy would like to thank Marc Deslauriers for reporting this=20
issue.

4. Solution:

Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which are=20
not installed but included in the list will not be updated. Note that you=
=20
can also use wildcards (*.rpm) if your current directory *only* contains=20
the desired RPMs.

Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the appropriate=
=20
RPMs being upgraded on your system. This assumes that you have yum or=20
apt-get configured for obtaining Fedora Legacy content. Please visit=20
http://www fedoralegacy.org/docs for directions on how to configure yum=20
and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us - 1734 - CAN-2004-0412 Mailman password retrieval

6. RPMs required:

Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/red...man-2.1.1-7.l=
egacy.src.rpm

i386:
http://download.fedoralegacy.org/red...an-2.1.1-7.le=
gacy.i386.rpm

7. Verification:

SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---

4dee398d2d9b1d107850665f04c082073b4465a5 =20
9/updates/SRPMS/mailman-2.1.1-7.legacy.src.rpm
66cbbfcf168869969b0aaa0298d3680c3b8e5a3c =20
9/updates/i386/mailman-2.1.1-7.legacy.i386.rpm

These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy org/about/security.php

You can verify each package with the following command:

rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:

sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename...DCAN-2004-0412
https://bugzilla.redhat.com/bugzilla...gi?id=3D123559
http://mail.python.org/pipermail/mai...ay/000072.html

9. Contact:

The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at http://www.fedoralegacy.org

=2D ---------------------------------------------------------------------

=2D --=20
Jesse Keating RHCE (http://geek.j2solutions.net)
=46edora Legacy Team (http://www.fedoralegacy.org)
GPG Public Key (http://geek.j2solutions.net/jkeating.j2solutions.pub)

Was I helpful? Let others know:
http://svcs.affero.net/rm.php?r=3Djkeating
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFA/KA94v2HLvE71NURAt/3AJ942eiZGscchS/7odKEbHIBdHiTkQCdFZ7A
lw5W/vaFcRxviBD3grWB6bs=3D
=3DdSXw
=2D----END PGP SIGNATURE-----