Endymion Mailman Default Configuration Vulnerability
BID:845
Info
Endymion Mailman Default Configuration Vulnerability
| Bugtraq ID: | 845 |
| Class: | Configuration Error |
| CVE: |
CVE-1999-0850 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 02 1999 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | First posted to BugTraq by jared <[email protected]> on December 2, 1999. |
| Vulnerable: |
Endymion Mailman Professional Edition 3.0.18 |
| Not Vulnerable: | |
Discussion
Endymion Mailman Default Configuration Vulnerability
Endymion mailman is a commercial www email suite which is written in perl. When it is installed, by default it sets permissions which make it vulnerable to local compromise (666 for files, 777 for directories). Because of this it is possible for local, unprivileged users to read and write to files owned by any MailMan users as well as the webserver.
Endymion mailman is a commercial www email suite which is written in perl. When it is installed, by default it sets permissions which make it vulnerable to local compromise (666 for files, 777 for directories). Because of this it is possible for local, unprivileged users to read and write to files owned by any MailMan users as well as the webserver.
Exploit / POC
Endymion Mailman Default Configuration Vulnerability
See discussion.
See discussion.
Solution / Fix
Endymion Mailman Default Configuration Vulnerability
Solution:
Endymion does warn customers to change permissions on software. A fix for this is to change the permissions to 0600 for the files and 0700 for the directories.
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue.If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Endymion does warn customers to change permissions on software. A fix for this is to change the permissions to 0600 for the files and 0700 for the directories.
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue.If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
Endymion Mailman Default Configuration Vulnerability
References:
References: