mlmmj (Mailing List Managing Made Joyful) Directory Traversal Vulnerability

Bugtraq ID:	41841
Class:	Input Validation Error
CVE:	CVE-2009-4896
Remote:	Yes
Local:	No
Published:	Jul 20 2010 12:00AM
Updated:	Dec 24 2014 12:55AM
Credit:	Florian Streibelt
Vulnerable:	mlmmj mlmmj 1.2.17 mlmmj mlmmj 1.2.16 mlmmj mlmmj 1.2.15 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:

mlmmj (Mailing List Managing Made Joyful) Directory Traversal Vulnerability

mlmmj (Mailing List Managing Made Joyful) is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

An authenticated user could exploit this vulnerability using directory-traversal strings to delete or overwrite arbitrary files. This may aid in further attacks.

mlmmj (Mailing List Managing Made Joyful) Directory Traversal Vulnerability

Attackers can use readily available tools and commands to exploit this issue.

mlmmj (Mailing List Managing Made Joyful) Directory Traversal Vulnerability

Solution:
Fixes are available. Please see the references for more details.


Debian Linux 5.0 hppa

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb


• Debian mlmmj_1.2.15-1.1+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+ lenny1_hppa.deb

Debian Linux 5.0 ia-64

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb


• Debian mlmmj_1.2.15-1.1+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+ lenny1_ia64.deb

Debian Linux 5.0 m68k

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb

Debian Linux 5.0 arm

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb


• Debian mlmmj_1.2.15-1.1+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+ lenny1_arm.deb

Debian Linux 5.0 armel

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb


• Debian mlmmj_1.2.15-1.1+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+ lenny1_armel.deb

Debian Linux 5.0

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb

Debian Linux 5.0 alpha

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb


• Debian mlmmj_1.2.15-1.1+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+ lenny1_alpha.deb

Debian Linux 5.0 amd64

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb


• Debian mlmmj_1.2.15-1.1+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+ lenny1_amd64.deb

Debian Linux 5.0 ia-32

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb


• Debian mlmmj_1.2.15-1.1+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+ lenny1_i386.deb

Debian Linux 5.0 mips

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb


• Debian mlmmj_1.2.15-1.1+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+ lenny1_mips.deb

Debian Linux 5.0 s/390

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb


• Debian mlmmj_1.2.15-1.1+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+ lenny1_s390.deb

Debian Linux 5.0 mipsel

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb


• Debian mlmmj_1.2.15-1.1+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+ lenny1_mipsel.deb

Debian Linux 5.0 powerpc

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb


• Debian mlmmj_1.2.15-1.1+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+ lenny1_powerpc.deb

Debian Linux 5.0 sparc

• Debian mlmmj-php-web-admin_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web-adm in_1.2.15-1.1+lenny1_all.deb


• Debian mlmmj-php-web_1.2.15-1.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj-php-web_1.2 .15-1.1+lenny1_all.deb


• Debian mlmmj_1.2.15-1.1+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/m/mlmmj/mlmmj_1.2.15-1.1+ lenny1_sparc.deb

mlmmj (Mailing List Managing Made Joyful) Directory Traversal Vulnerability

References:

• mlmmj Homepage (mlmmj)