GNU Mailman Local Format String Vulnerability
BID:1539
Info
GNU Mailman Local Format String Vulnerability
| Bugtraq ID: | 1539 |
| Class: | Input Validation Error |
| CVE: |
CVE-2000-0701 |
| Remote: | No |
| Local: | Yes |
| Published: | Aug 01 2000 12:00AM |
| Updated: | Jul 11 2009 02:56AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list on August 2, 2000 by Stan Bubrouski <[email protected]> |
| Vulnerable: |
GNU Mailman 2.0 beta4 GNU Mailman 2.0 beta3 |
| Not Vulnerable: |
SuSE Linux 7.0 Mandriva Linux Mandrake 7.1 Mandriva Linux Mandrake 6.1 Mandriva Linux Mandrake 6.0 GNU Mailman 2.0 beta5 GNU Mailman 1.1 GNU Mailman 1.0 |
Discussion
GNU Mailman Local Format String Vulnerability
A vulnerability exists in the GNU Mailman list package. Versions 2.0beta3 and 2.0beta4 contain a vulnerability which can yield group mailman access. By supplying a well formed string, containing format strings, it may be possible to overwrite values on the stack of the running process, and execute arbitrary commands with the privileges of the 'wrapper' program. This program is installed setgid mailman. Upon acquiring GID mailman, it may be possible for an attacker to modify other binaries, and further elevate access.
A vulnerability exists in the GNU Mailman list package. Versions 2.0beta3 and 2.0beta4 contain a vulnerability which can yield group mailman access. By supplying a well formed string, containing format strings, it may be possible to overwrite values on the stack of the running process, and execute arbitrary commands with the privileges of the 'wrapper' program. This program is installed setgid mailman. Upon acquiring GID mailman, it may be possible for an attacker to modify other binaries, and further elevate access.
Exploit / POC
GNU Mailman Local Format String Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
GNU Mailman Local Format String Vulnerability
Solution:
This vulnerability is fixed in version 2.0beta5 of Mailman.
GNU Mailman 2.0 beta3
GNU Mailman 2.0 beta4
Solution:
This vulnerability is fixed in version 2.0beta5 of Mailman.
GNU Mailman 2.0 beta3
-
Mailman Mailman 2.0beta5
http://www.gnu.org/software/mailman/mailman.html
GNU Mailman 2.0 beta4
-
Mailman Mailman 2.0beta5
http://www.gnu.org/software/mailman/mailman.html