Bugzilla – Bug 49442
VUL-0: CVE-2004-0182: mailman: remote denial-of-service
Last modified: 2021-10-11 13:36:41 UTC
Hi Heiko, this is just for the sake of completeness. You are already aware of the remote denial of service condition in mailman that affect 2.0.x only (8.1/SLES8).
<!-- SBZ_reproduce --> -
Heike, 8.0 include mailman too.
Sorry! s/Heike/Heiko/ ;)
Created attachment 15935 [details] patchinfo.mailman
Created attachment 15936 [details] patchinfo-box.mailman This includes 8.0 and 8.1
fixed in SLES8, 8.0 and 8.1 (apropro "Heike": I forgive you - this time ;)
<!-- SBZ_reopen -->Reopened by thomas@suse.de at Wed Feb 11 16:58:20 2004
reassigned to me for tracking
Hi HeikO. The problems seems still not to be fixed. thomas@bragg:~> cat /work/src/done/8.0/mailman.note Why is this necessary and what is the bugzilla ID? Which project manager approved this? thomas@bragg:~> cat /work/src/done/8.1/mailman.note There are no changes on this package? thomas@bragg:~>
If I understood the objections of the autobuild guys correctly (remember: they rejected my commit), the security manager has to get an OK from the product manager for a version update. If we have that OK or if it to me to get that OK from the product manager, please let me know.
As we discussed some weeks ago: The cleanest way would be to add the patch to the version shipped with this specific SL version. If this patch is too complex or there is another serious reason to update the version, the productmanager must give his/her "ok". Is that the case?
I don't think so. I'll just downgrade the patch.
Thank you!
Fixed in 8.0 including patchinfo for 8.0 and 8.1(already commited).
<!-- SBZ_reopen -->Reopened by thomas@suse.de at Tue Mar 16 18:28:34 2004
reassigned to me for tracking....
Is this a hit? Date: Fri, 2 Apr 2004 10:36:02 +0100 (BST) From: Mark J Cox <mjc@redhat.com> To: vendor-sec@lst.de Cc: jdennis@redhat.com Subject: [vendor-sec] mailman issue Red Hat issued security erratum on February 19 2004, RHSA-2004:019, to correct a DoS (Denial of Service) vulnerability where an attacker could send a carefully-crafted message causing mailman to crash. CAN-2003-0991 Matthew Saltzman discovered a flaw in our original patch (whitespace indentation problems) to correct this vulnerability. This flaw can cause mailman to crash if it receives an email destined for a list with an empty subject field. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0182 to this issue. Not sure if this will affect any other vendors, here is the bug id: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=118669 If anyone is, please let me know and we can co-ordinate. Cheers, Mark
Heiko, can you check our patch please.
Dear QA-Team, the following link describes a bug in the mailman patch we might have been affected too. http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=118669 Can you test this please?
JFYI: On Apr 5, 2004, at 10:16 AM, Vincent Danen wrote: > > On Apr 2, 2004, at 6:32 AM, Josh Bressers wrote: > > > > Red Hat issued security erratum on February 19 2004, RHSA-2004:019, to > > > correct a DoS (Denial of Service) vulnerability where an attacker could > > > send a carefully-crafted message causing mailman to crash. CAN-2003-0991 > > > > > > Matthew Saltzman discovered a flaw in our original patch (whitespace > > > indentation problems) to correct this vulnerability. This flaw can cause > > > mailman to crash if it receives an email destined for a list with an empty > > > subject field. The Common Vulnerabilities and Exposures project > > > (cve.mitre.org) has assigned the name CAN-2004-0182 to this issue. > > > > > > Not sure if this will affect any other vendors, here is the bug id: > > > http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=118669 > > > > > > If anyone is, please let me know and we can co-ordinate. > > > > Mark, > > > > Progeny is affected by this for our transition service. > > > > April 14 perhaps? :) > > > > > From what I've seen in your BTS, the new fix just drops a bad message. Is > > your plan to fix this in a more graceful manner, or is the 2 line patch > > what you guys are going with? > > Looks like we need to get on board with this as well. The 14th will work for us. > > So all that needs to be done is to decrease the indentation one level? Sounds easy enough... =) On second glance, this does not affect us. -- Mandrakesoft Security; http://www.mandrakesecure.net/
I can't reproduce this behaviour with SLES8. All I get while posting a message WITH NO SUBJECT is a posting with a subject line containing "(no subject)". I verified that Subject was not added by an intermediate MTA.
<!-- SBZ_reopen -->Reopened by thomas@suse.de at Mon Apr 5 20:30:58 2004
Ok, thank you a lot! reasigned to me for tracking.
packages approved.
CVE-2004-0182: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)