| Description: | Description:
The remote host is missing an update to mailman
announced via advisory USN-345-1.
A security issue affects the following Ubuntu releases:
Ubuntu 5.04
Ubuntu 5.10
Ubuntu 6.06 LTS
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
Steve Alexander discovered that mailman did not properly handle
attachments with special filenames. A remote user could exploit that
to stop mail delivery until the server administrator manually cleaned
these posts. (CVE-2006-2941)
Various cross-site scripting vulnerabilities have been reported by
Barry Warsaw. By using specially crafted email addresses, names, and
similar arbitrary user-defined strings, a remote attacker could
exploit this to run web script code in the list administrator's
web browser. (CVE-2006-3636)
URLs logged to the error log file are now checked for invalid
characters. Before, specially crafted URLs could inject arbitrary
messages into the log.
Solution:
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 5.04:
mailman 2.1.5-7ubuntu0.3
Ubuntu 5.10:
mailman 2.1.5-8ubuntu2.3
Ubuntu 6.06 LTS:
mailman 2.1.5-9ubuntu4.1
In general, a standard system upgrade is sufficient to effect the
necessary changes.
http://www.securityspace.com/smysecure/catid.html?in=USN-345-1
Risk factor : High
CVSS Score:
6.8
|
