Sympa List Creation Authentication Bypass Vulnerability

Bugtraq ID:	10941
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 13 2004 12:00AM
Updated:	Aug 13 2004 12:00AM
Credit:	This vulnerability was disclosed by the vendor.
Vulnerable:	Sympa Sympa 4.1.1 Sympa Sympa 4.1 Sympa Sympa 4.0 .x Sympa Sympa 3.x Sympa Sympa 2.x
Not Vulnerable:	Sympa Sympa 4.1.2

Sympa List Creation Authentication Bypass Vulnerability

Sympa is reported to be prone to an authentication bypass vulnerability when creating new mailing lists.

This vulnerability presents itself upon creating a new mailing list. The list master approval process could reportedly be skipped by an attacker.

An attacker may exploit this issue to create unauthorized mailing lists. This may possibly be used to forward UCE messages, or possibly other attacks.

Versions prior to 4.1.2 are reportedly affected by this vulnerability.

Sympa List Creation Authentication Bypass Vulnerability

An exploit is not required.

Sympa List Creation Authentication Bypass Vulnerability

Solution:
The vendor has released version 4.1.2 addressing this issue:


Sympa Sympa 3.x

• Sympa sympa-4.1.2.tar.gz
  http://www.sympa.org/distribution/sympa-4.1.2.tar.gz

Sympa Sympa 2.x

• Sympa sympa-4.1.2.tar.gz
  http://www.sympa.org/distribution/sympa-4.1.2.tar.gz

Sympa Sympa 4.0 .x

• Sympa sympa-4.1.2.tar.gz
  http://www.sympa.org/distribution/sympa-4.1.2.tar.gz

Sympa Sympa 4.1

• Sympa sympa-4.1.2.tar.gz
  http://www.sympa.org/distribution/sympa-4.1.2.tar.gz

Sympa Sympa 4.1.1

• Sympa sympa-4.1.2.tar.gz
  http://www.sympa.org/distribution/sympa-4.1.2.tar.gz

Sympa List Creation Authentication Bypass Vulnerability

References:

• Release notes (Sympa)
  
• Sympa Home Page (Sympa)