Synopsis

mailman security update

Type/Severity

Security Advisory: Important

Topic

An updated mailman package that corrects a cross-site scripting flaw is now
available.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

Mailman manages electronic mail discussion and e-newsletter lists.

A cross-site scripting (XSS) flaw in the driver script of mailman prior to
version 2.1.5 could allow remote attackers to execute scripts as other web
users. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2004-1177 to this issue.

Users of mailman should update to this erratum package, which corrects this
issue by turning on STEALTH_MODE by default and using Utils.websafe() to
quote the html.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 132750 - Mailman doesn't work with courier
• BZ - 142605 - init script doesn't use /var/lock/subsys
• BZ - 143008 - mailman logrotate has wrong location for mailmanctl
• BZ - 147833 - CAN-2004-1177 - mailman

CVEs

• CVE-2004-1177

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
mailman-2.1.5-33.rhel4.src.rpm	SHA-256: def507678cf235c89f3421674830bece3d1ecd6d49ffe8509571101f184086ec
x86_64
mailman-2.1.5-33.rhel4.x86_64.rpm	SHA-256: b7d6354e9e5fae7d83adeab179557fd4a3c219cd5cfb8ff4ce3f2e6467587c31
mailman-2.1.5-33.rhel4.x86_64.rpm	SHA-256: b7d6354e9e5fae7d83adeab179557fd4a3c219cd5cfb8ff4ce3f2e6467587c31
ia64
mailman-2.1.5-33.rhel4.ia64.rpm	SHA-256: 075c38db6ca3c5cf9bcd5433e0ec84d08310c2fb06a7b21b7b7b4a37cbbdac91
mailman-2.1.5-33.rhel4.ia64.rpm	SHA-256: 075c38db6ca3c5cf9bcd5433e0ec84d08310c2fb06a7b21b7b7b4a37cbbdac91
i386
mailman-2.1.5-33.rhel4.i386.rpm	SHA-256: 37b1a921c25832cc250e75d46cadc46a3df6bc3b5e4e6b4e365cf8157737bcdb
mailman-2.1.5-33.rhel4.i386.rpm	SHA-256: 37b1a921c25832cc250e75d46cadc46a3df6bc3b5e4e6b4e365cf8157737bcdb

Red Hat Enterprise Linux Workstation 4

SRPM
mailman-2.1.5-33.rhel4.src.rpm	SHA-256: def507678cf235c89f3421674830bece3d1ecd6d49ffe8509571101f184086ec
x86_64
mailman-2.1.5-33.rhel4.x86_64.rpm	SHA-256: b7d6354e9e5fae7d83adeab179557fd4a3c219cd5cfb8ff4ce3f2e6467587c31
ia64
mailman-2.1.5-33.rhel4.ia64.rpm	SHA-256: 075c38db6ca3c5cf9bcd5433e0ec84d08310c2fb06a7b21b7b7b4a37cbbdac91
i386
mailman-2.1.5-33.rhel4.i386.rpm	SHA-256: 37b1a921c25832cc250e75d46cadc46a3df6bc3b5e4e6b4e365cf8157737bcdb

Red Hat Enterprise Linux Desktop 4

SRPM
mailman-2.1.5-33.rhel4.src.rpm	SHA-256: def507678cf235c89f3421674830bece3d1ecd6d49ffe8509571101f184086ec
x86_64
mailman-2.1.5-33.rhel4.x86_64.rpm	SHA-256: b7d6354e9e5fae7d83adeab179557fd4a3c219cd5cfb8ff4ce3f2e6467587c31
i386
mailman-2.1.5-33.rhel4.i386.rpm	SHA-256: 37b1a921c25832cc250e75d46cadc46a3df6bc3b5e4e6b4e365cf8157737bcdb

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
mailman-2.1.5-33.rhel4.src.rpm	SHA-256: def507678cf235c89f3421674830bece3d1ecd6d49ffe8509571101f184086ec
s390x
mailman-2.1.5-33.rhel4.s390x.rpm	SHA-256: c6b4027cf1e08d4126d7621ee39d9ff7a98e75086f6a04863c1021322cf9f14a
s390
mailman-2.1.5-33.rhel4.s390.rpm	SHA-256: 977425bc40fa0e76174edee86d3ffef6fe94a2f2ed93df2b4bf40f3ed932e86a

Red Hat Enterprise Linux for Power, big endian 4

SRPM
mailman-2.1.5-33.rhel4.src.rpm	SHA-256: def507678cf235c89f3421674830bece3d1ecd6d49ffe8509571101f184086ec
ppc
mailman-2.1.5-33.rhel4.ppc.rpm	SHA-256: 17d1154f3aa33390d21235b9c7f8f234831e9bdfa3beb2e3829c15427d5e0aad