Synopsis

mailman security update

Type/Severity

Security Advisory: Important

Topic

Updated mailman packages to correct a security issue are now
available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

Mailman is software to help manage email discussion lists.

A flaw in the true_path function of Mailman was discovered. A remote
attacker who is a member of a private mailman list could use a carefully
crafted URL and gain access to arbitrary files on the server. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2005-0202 to this issue.

Note: Mailman installations running on Apache 2.0-based servers are not
vulnerable to this issue.

Users of Mailman should update to these erratum packages that contain a
patch and are not vulnerable to this issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 147344 - CAN-2005-0202 mailman flaw

CVEs

• CVE-2005-0202

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
mailman-2.1.5-31.rhel4.src.rpm	SHA-256: 2e660f330a4d1f69c2ef50e852b73abaad386b0ec9b1a44e5d13d790ba6f1e20
x86_64
mailman-2.1.5-31.rhel4.x86_64.rpm	SHA-256: 105966247c249ea32be582c32064063b302e3ddc60c60caf99b0c7cfbdae9b71
mailman-2.1.5-31.rhel4.x86_64.rpm	SHA-256: 105966247c249ea32be582c32064063b302e3ddc60c60caf99b0c7cfbdae9b71
ia64
mailman-2.1.5-31.rhel4.ia64.rpm	SHA-256: b1fc6a381f83c73847e73b4e88401ffb697e7e359bac56ac3155d717cb934763
mailman-2.1.5-31.rhel4.ia64.rpm	SHA-256: b1fc6a381f83c73847e73b4e88401ffb697e7e359bac56ac3155d717cb934763
i386
mailman-2.1.5-31.rhel4.i386.rpm	SHA-256: 4b8a2c9d4b507c236f71b4fe08c623070591e7242906bdc66484e0d3bb0a1ed6
mailman-2.1.5-31.rhel4.i386.rpm	SHA-256: 4b8a2c9d4b507c236f71b4fe08c623070591e7242906bdc66484e0d3bb0a1ed6

Red Hat Enterprise Linux Workstation 4

SRPM
mailman-2.1.5-31.rhel4.src.rpm	SHA-256: 2e660f330a4d1f69c2ef50e852b73abaad386b0ec9b1a44e5d13d790ba6f1e20
x86_64
mailman-2.1.5-31.rhel4.x86_64.rpm	SHA-256: 105966247c249ea32be582c32064063b302e3ddc60c60caf99b0c7cfbdae9b71
ia64
mailman-2.1.5-31.rhel4.ia64.rpm	SHA-256: b1fc6a381f83c73847e73b4e88401ffb697e7e359bac56ac3155d717cb934763
i386
mailman-2.1.5-31.rhel4.i386.rpm	SHA-256: 4b8a2c9d4b507c236f71b4fe08c623070591e7242906bdc66484e0d3bb0a1ed6

Red Hat Enterprise Linux Desktop 4

SRPM
mailman-2.1.5-31.rhel4.src.rpm	SHA-256: 2e660f330a4d1f69c2ef50e852b73abaad386b0ec9b1a44e5d13d790ba6f1e20
x86_64
mailman-2.1.5-31.rhel4.x86_64.rpm	SHA-256: 105966247c249ea32be582c32064063b302e3ddc60c60caf99b0c7cfbdae9b71
i386
mailman-2.1.5-31.rhel4.i386.rpm	SHA-256: 4b8a2c9d4b507c236f71b4fe08c623070591e7242906bdc66484e0d3bb0a1ed6

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
mailman-2.1.5-31.rhel4.src.rpm	SHA-256: 2e660f330a4d1f69c2ef50e852b73abaad386b0ec9b1a44e5d13d790ba6f1e20
s390x
mailman-2.1.5-31.rhel4.s390x.rpm	SHA-256: 23131c93d009af3f85dda4396be36f10a169b0ef9e5b28bf8763b7b1437cccab
s390
mailman-2.1.5-31.rhel4.s390.rpm	SHA-256: 5464e2971b1df1b090e0531eb28ee014ce7713edd0a5273fbd6a503176dcb388

Red Hat Enterprise Linux for Power, big endian 4

SRPM
mailman-2.1.5-31.rhel4.src.rpm	SHA-256: 2e660f330a4d1f69c2ef50e852b73abaad386b0ec9b1a44e5d13d790ba6f1e20
ppc
mailman-2.1.5-31.rhel4.ppc.rpm	SHA-256: 0bfb5833c2406fdea84a52cf8bfb4e541a479816fc2e05322aad43189ecc8c53