BID:3295

GNU Mailman Empty Password Blank Salt Vulnerability

Info

GNU Mailman Empty Password Blank Salt Vulnerability

Bugtraq ID:	3295
Class:	Environment Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 05 2001 12:00AM
Updated:	Sep 05 2001 12:00AM
Credit:	This vulnerability was announced to Bugtraq in a Conectiva Security Advisory on September 5, 2001.
Vulnerable:	GNU Mailman 2.0.5 - Debian Linux 2.2 sparc - Debian Linux 2.2 powerpc - Debian Linux 2.2 arm - Debian Linux 2.2 alpha - Debian Linux 2.2 68k - Debian Linux 2.2 - FreeBSD FreeBSD 4.3 - HP HP-UX 11.11 - HP HP-UX 11.0 - HP HP-UX 10.20 - Mandriva Linux Mandrake 8.0 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - NetBSD NetBSD 1.5.2 - NetBSD NetBSD 1.5.1 - OpenBSD OpenBSD 2.9 - OpenBSD OpenBSD 2.8 - OpenBSD OpenBSD 2.7 - Redhat Linux 7.1 - Redhat Linux 7.0 - Slackware Linux 8.0 - Slackware Linux 7.1 - Slackware Linux 7.0 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.2 - SuSE Linux 7.1 - SuSE Linux 7.0 GNU Mailman 2.0.4 GNU Mailman 2.0.3 GNU Mailman 2.0.2 GNU Mailman 2.0.1 GNU Mailman 2.0

Not Vulnerable:	GNU Mailman 2.0.6

Discussion

GNU Mailman Empty Password Blank Salt Vulnerability

GNU Mailman is a freely available, open source mailing list manager written in Python, and maintained by public domain.

A problem has been discovered in GNU Mailman that can allow users arbitrary access to accounts. When a password file has been created, but left blank, it is possible for a remote user to gain access to a user account as by entering an arbitrary password of any type. This is due to a bug in the crypt function, which upon receiving a blank salt, will return a blank hash.

Exploit / POC

GNU Mailman Empty Password Blank Salt Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.