Re: [SECURITY] [DSA 674-3] New mailman packages really fix several vulnerabilities

[Hideki Yamane <henrich@xxxxxxxxxxxxxx>]

　やまねです。

  "Mon, 21 Feb 2005 11:29:17 +0100 (CET)", "Martin Schulze"
  "[SECURITY] [DSA 674-3] New mailman packages really fix several vulnerabilities"

　この[DSA 674-3]、webの方には反映されていないようなんですが、
　理由をご存知の方いますか？


>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>- --------------------------------------------------------------------------
>Debian Security Advisory DSA 674-3                     security@debian.org
>http://www.debian.org/security/                             Martin Schulze
>February 21st, 2005                     http://www.debian.org/security/faq
>- --------------------------------------------------------------------------
>
>Package        : mailman
>Vulnerability  : cross-site scripting, directory traversal
>Problem-Type   : remote
>Debian-specific: no
>CVE ID         : CAN-2004-1177 CAN-2005-0202
>
>Due to an incompatibility between Python 1.5 and 2.1 the last mailman
>update did not run with Python 1.5 anymore.  This problem is corrected
>with this update.  This advisory only updates the packages updated
>with DSA 674-2.  The version in unstable is not affected since it is
>not supposed to work with Python 1.5 anymore.  For completeness below
>is the original advisory text:
>
>  Two security related problems have been discovered in mailman,
>  web-based GNU mailing list manager.  The Common Vulnerabilities and
>  Exposures project identifies the following problems:
>
>  CAN-2004-1177
>
>      Florian Weimer discovered a cross-site scripting vulnerability in
>      mailman's automatically generated error messages.  An attacker
>      could craft an URL containing JavaScript (or other content
>      embedded into HTML) which triggered a mailman error page that
>      would include the malicious code verbatim.
>
>  CAN-2005-0202
>
>      Several listmasters have noticed unauthorised access to archives
>      of private lists and the list configuration itself, including the
>      users passwords.  Administrators are advised to check the
>      webserver logfiles for requests that contain "/...../" and the
>      path to the archives or cofiguration.  This does only seem to
>      affect installations running on web servers that do not strip
>      slashes, such as Apache 1.3.
>
>For the stable distribution (woody) these problems have been fixed in
>version 2.0.11-1woody11.
>
>We recommend that you upgrade your mailman package.
>
>
>Upgrade Instructions
>- --------------------
>
>wget url
>        will fetch the file for you
>dpkg -i file.deb
>        will install the referenced file.
>
>If you are using the apt-get package manager, use the line for
>sources.list as given below:
>
>apt-get update
>        will update the internal database
>apt-get upgrade
>        will install corrected packages
>
>You may use an automated update by adding the resources from the
>footer to the proper configuration.
>
>
>Debian GNU/Linux 3.0 alias woody
>- --------------------------------
>
>  Source archives:
>
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11-1woody11.dsc
>      Size/MD5 checksum:      597 2bd1ff64a1bdaa6655656c5ec2b10db8
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11-1woody11.diff.gz
>      Size/MD5 checksum:    33161 6b4be5023a62ba488398a174bd9139fe
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11.orig.tar.gz
>      Size/MD5 checksum:   415129 915264cb1ac8d7b78ea9eff3ba38ee04
>
>  Alpha architecture:
>
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11-1woody11_alpha.deb
>      Size/MD5 checksum:   461712 8ccd3f0c5cf0791f885f5e0850e2d37c
>
>  ARM architecture:
>
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11-1woody11_arm.deb
>      Size/MD5 checksum:   459286 72cef07f59aa7cd0f0a77c26a3b7dc77
>
>  Intel IA-32 architecture:
>
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11-1woody11_i386.deb
>      Size/MD5 checksum:   452438 3b7179c3d729f392d129d185cd3641db
>
>  Intel IA-64 architecture:
>
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11-1woody11_ia64.deb
>      Size/MD5 checksum:   462256 34338a3fab74b3af221e89cffb0d7eb9
>
>  HP Precision architecture:
>
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11-1woody11_hppa.deb
>      Size/MD5 checksum:   459964 c772ec5f0b1274f7460d4336f7ec7dee
>
>  Motorola 680x0 architecture:
>
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11-1woody11_m68k.deb
>      Size/MD5 checksum:   459408 a6413a53de20e77e50b8403b18dadfa8
>
>  Big endian MIPS architecture:
>
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11-1woody11_mips.deb
>      Size/MD5 checksum:   459984 ca6ac0ebd589bb1cf3b716ab3f6df8d2
>
>  Little endian MIPS architecture:
>
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11-1woody11_mipsel.deb
>      Size/MD5 checksum:   460088 b3b5426e9a88dd7ab43cf3160ef1a3e9
>
>  PowerPC architecture:
>
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11-1woody11_powerpc.deb
>      Size/MD5 checksum:   460248 db24ceb03ca9f678d1ec89eacc74694a
>
>  IBM S/390 architecture:
>
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11-1woody11_s390.deb
>      Size/MD5 checksum:   460300 f51f741f3e1dfe80981e59e4fdc9b238
>
>  Sun Sparc architecture:
>
>    http://security.debian.org/pool/updates/main/m/mailman/mailman_2.0.11-1woody11_sparc.deb
>      Size/MD5 checksum:   465056 e140e8b13fbf54ecb25d9f4d50d9da44
>
>
>  These files will probably be moved into the stable distribution on
>  its next update.
>
>- ---------------------------------------------------------------------------------
>For apt-get: deb http://security.debian.org/ stable/updates main
>For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
>Mailing list: debian-security-announce@lists.debian.org
>Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
>
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.4.0 (GNU/Linux)
>
>iD8DBQFCGbf8W5ql+IAeqTIRAo9JAKCD0ut8FBMPjLyR6ny5LTnbKhbXfQCgkJD9
>s80Hsthn4vlbG5Et9QjPC7c=
>=a2/h
>-----END PGP SIGNATURE-----
-- 
Regards,

 Hideki Yamane    mailto:henrich @ iijmio-mail.jp