Test ID:	1.3.6.1.4.1.25623.1.0.53502
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 674-1 (mailman)
Summary:	The remote host is missing an update to mailman announced via advisory DSA 674-1.;; This VT has been deprecated and merged into the VT 'Debian: Security Advisory (DSA-674)' (OID: 1.3.6.1.4.1.25623.1.0.53505).
Description:	Summary: The remote host is missing an update to mailman announced via advisory DSA 674-1. This VT has been deprecated and merged into the VT 'Debian: Security Advisory (DSA-674)' (OID: 1.3.6.1.4.1.25623.1.0.53505). Vulnerability Insight: Two security related problems have been discovered in mailman, web-based GNU mailing list manager. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2004-1177 Florian Weimer discovered a cross-site scripting vulnerability in mailman's automatically generated error messages. An attacker could craft an URL containing JavaScript (or other content embedded into HTML) which triggered a mailman error page that would include the malicious code verbatim. CVE-2005-0202 Several listmasters have noticed unauthorised access to archives of private lists and the list configuration itself, including the users passwords. Administrators are advised to check the webserver logfiles for requests that contain /...../ and the path to the archives or configuration. This does only seem to affect installations running on web servers that do not strip slashes, such as Apache 1.3. For the stable distribution (woody) these problems have been fixed in version 2.0.11-1woody9. For the unstable distribution (sid) these problems have been fixed in version 2.1.5-6. Solution: We recommend that you upgrade your mailman package. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2004-1177 Bugtraq: 20050110 [USN-59-1] mailman vulnerabilities (Google Search) http://marc.info/?l=bugtraq&m=110549296126351&w=2 Debian Security Information: DSA-674 (Google Search) http://www.debian.org/security/2005/dsa-674 http://www.mandriva.com/security/advisories?name=MDKSA-2005:015 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11113 http://www.redhat.com/support/errata/RHSA-2005-235.html http://secunia.com/advisories/13603 SuSE Security Announcement: SUSE-SA:2005:007 (Google Search) http://www.novell.com/linux/security/advisories/2005_07_mailman.html XForce ISS Database: mailman-script-driver-xss(18854) https://exchange.xforce.ibmcloud.com/vulnerabilities/18854 Common Vulnerability Exposure (CVE) ID: CVE-2005-0202 http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html Bugtraq: 20050209 [USN-78-1] Mailman vulnerability (Google Search) http://marc.info/?l=bugtraq&m=110805795122386&w=2 http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031562.html http://www.gentoo.org/security/en/glsa/glsa-200502-11.xml http://www.mandriva.com/security/advisories?name=MDKSA-2005:037 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10657 http://www.redhat.com/support/errata/RHSA-2005-136.html http://www.redhat.com/support/errata/RHSA-2005-137.html http://securitytracker.com/id?1013145 http://secunia.com/advisories/14211
Copyright	Copyright (C) 2008 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.