Vulnerability
mailman
Affected
mailman 2.0beta3, 2.0beta4
Description
Stan Bubrouski found following. Most directories in a mailman
install are mode 2755 as are most of the binaries and scripts.
Many configurations are 664 allowing a local user to change list
configurations and even read the adm.pw passwd file. Additionally
besides being able to read public and private data along with
passwds, a malicious user could replace binaries and scripts in a
mailman installation because they are writable by group mailman.
The mailman package comes with a sgid program named wrapper. This
program contains a function named fatal() which is used to display
error messages. Unfortunately it fails to send the correct amount
of arguments to the fprintf(3) function allowing users to add
formatting which could be used to insert and execute code under
group mailman. fatal() is called when invalid arguments are
provided and in such a case, the invalid arguments are sent to
fprintf without being formatted, the same goes for argv[0].
Example:
[user@king user]$ ls -al /usr/share/mailman/mail/wrapper
-rwxr-sr-x 1 mailman mailman 36290 Jul 1 06:48
/usr/share/mailman/mail/wrapper
[user@king user]$ cd /usr/share/mailman/mail
[user@king mail]$ ls -al
total 39
drwxrwsr-x 2 mailman mailman 1024 Jul 12 19:29 .
drwxrwsr-x 16 mailman mailman 1024 Jul 27 20:13 ..
-rwxr-sr-x 1 mailman mailman 36290 Jul 1 06:48 wrapper
[user@king mail]$ ./wrapper
Usage: ./wrapper program [args...]
[user@king mail]$ ./wrapper %s
Illegal command: Illegal command: %s[user@king mail]$ ./wrapper %s%s
Illegal command: Illegal command: %s%s•ýÿ¿œ=@„üÿ¿Xüÿ¿€>@[user@king
mail]$ ./wrapper %s%s%s
Segmentation fault
[user@king mail]$ ./wrapper %s%u%p
Illegal command: Illegal command: %s%u%p32212244600x656c6c49[user@king mail]$
[user@king mail]$ doexec ./wrapper %s
Usage: Usage: %s program [args...]
program [args...]
[user@king mail]$ doexec ./wrapper %s%s
Usage: Usage: %s%s program [args...]
“ýÿ¿œ=@„üÿ¿Xüÿ¿€>@ program [args...]
[user@king mail]$ doexec ./wrapper %s%p
Usage: Usage: %s%p program [args...]
0xbffffc0c program [args...]
[user@king mail]$ doexec ./wrapper %s%S%u
Usage: Usage: %s%S%u program [args...]
[user@king mail]$ doexec ./wrapper %s%s
Usage: Usage: %s%s program [args...]
“ýÿ¿œ=@„üÿ¿Xüÿ¿€>@ program [args...]
[user@king mail]$ doexec ./wrapper %s%s%s
Segmentation fault
[user@king mail]$
Solution
Patch:
diff -u -r ./cgi-wrapper.c.orig ./cgi-wrapper.c
--- ./cgi-wrapper.c.orig Tue Mar 21 01:26:41 2000
+++ ./cgi-wrapper.c Fri Jul 28 00:17:42 2000
@@ -53,7 +53,7 @@
fake_argv[2] = script;
status = run_script("driver", 3, fake_argv, env);
- fatal(logident, status, "%s", strerror(errno));
+ fatal(logident, status, "%s\n", strerror(errno));
return status;
}
diff -u -r common.c.orig ./common.c
--- ./common.c.orig Mon May 22 14:59:31 2000
+++ ./common.c Thu Jul 27 23:58:12 2000
@@ -108,7 +108,7 @@
printf("</pre>\n");
}
else
- fprintf(stderr, log_entry);
+ fprintf(stderr, "%s", log_entry);
#endif /* HELPFUL */
exit(exitcode);
}
diff -u -r ./mail-wrapper.c.orig ./mail-wrapper.c
--- ./mail-wrapper.c.orig Tue Mar 21 01:26:41 2000
+++ ./mail-wrapper.c Fri Jul 28 00:16:34 2000
@@ -67,13 +67,13 @@
if (!check_command(argv[1]))
fatal(logident, MAIL_ILLEGAL_COMMAND,
- "Illegal command: %s", argv[1]);
+ "Illegal command: %s\n", argv[1]);
check_caller(logident, parentgid);
/* If we got here, everything must be OK */
status = run_script(argv[1], argc, argv, env);
- fatal(logident, status, "%s", strerror(errno));
+ fatal(logident, status, "%s\n", strerror(errno));
return status;
}
The patch fixes fatal() and also adds newlines to some fatal()
calls because fatal() does not tack them on and as you can see in
the example above, the lack of newlines in some calls make errors
harder to read. Stan made the patch using the latest CVS tree
but it should apply to beta3 and beta4 releases as well.
Also, Mailman 2.0 beta 5 was released. This is an important bug
fix release that should once and for all solve the "cookie
re-authentication" bug. It also fixes a small security hole that
could be exploited by clever local users to gain group mailman
permission. As usual, you can get the tarball from SourceForge:
http://download.sourceforge.net/mailman/mailman-2.0beta5.tgz
or list.org
http://www.list.org/mailman.tar.gz
For Conectiva Linux:
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/4.1/i386/mailman-2.0beta5-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/4.2/i386/mailman-2.0beta5-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/mailman-2.0beta5-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.1/i386/mailman-2.0beta5-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/4.1/SRPMS/mailman-2.0beta5-1cl.src.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/4.2/SRPMS/mailman-2.0beta5-1cl.src.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/SRPMS/mailman-2.0beta5-1cl.src.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.1/SRPMS/mailman-2.0beta5-1cl.src.rpm
For Red Hat:
ftp://updates.redhat.com/secureweb/3.2/i386/mailman-2.0beta5-1.i386.rpm
ftp://updates.redhat.com/secureweb/3.2/SRPMS/mailman-2.0beta5-1.src.rpm
SuSE-Linux either does not contain these packages or the files
therein causing the publically announced security vulnerabilities.
Linux-Mandrake does not ship with the mailman package and is
therefore not vulnerable to this exploit.
Debian GNU/Linux 2.1 alias slink comes with version 1.0 that is
not vulnerable. Debian 2.2 alias potato comes with version 1.1
that is not vulnerable. Debian Unstable alias woody is not yet
released and reflects the current development release. Fixes are
currently available for Intel ia32 and Motorola 680x0. Fixes for
other architectures will be available soon. In doubt, please
recompile the package from source on your own:
ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5-1.diff.gz
ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5-1.dsc
ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5.orig.tar.gz
ftp://ftp.debian.org/debian/dists/woody/main/binary-i386/mail/mailman_2.0beta5-1.deb
ftp://ftp.debian.org/debian/dists/woody/main/binary-m68k/mail/mailman_2.0beta5-1.deb
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2025 AOH
