[UNIX] Pipermail Permissions Problem

From: support@securiteam.com
Date: 04/17/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Wed, 17 Apr 2002 11:52:43 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Pipermail Permissions Problem
------------------------------------------------------------------------

SUMMARY

 <http://sourceforge.net/projects/mailman/> Mailman is the GNU mailing
list manager. It provides standard list management features, integrated
with a web interface. Pipermail is a mailing list archiving software
distributed with and integrated with Mailman. A security vulnerability in
the product allows local attackers to view archived (possibly private)
mailing list archives without requiring any special security privileges.

DETAILS

If you have (a) private Mailman mailing lists and (b) user logins on the
same machine, any local user can read the archives of those private
mailing lists.

$mailman_root/archive/private is o+x in the default installation. This
allows anyone with local access to the machine to read the archives of
private mailing lists, as long as they know the (trivial) structure of the
files beneath this directory.

Note:
Changing this directory to o-x causes *all* Pipermail pages to become
inaccessible, so that does not resolve the problem.

Vendor response:
"I'm not inclined to fix this, since this arrangement is crucial to the
web security of private archives. Since Mailman is usually run on mail
and/or web servers that have very limited access anyway, I don't consider
this an important vulnerability." - Barry Warsaw

ADDITIONAL INFORMATION

The information has been provided by <mailto:hpa@zytor.com> H. Peter
Anvin.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [TOOL] Fakebust - Fake Exploit Code Detector
    ... Get your security news from a reliable source. ... Fakebust is a simple, open-source, user-friendly, intuitive and very rapid ... sources or binaries recovered from Usenet groups, mailing lists, various ... indeed works is to execute it - but if it turns out to be a Trojan horse, ...
    (Securiteam)
  • [Full-Disclosure] Security Industry Under Scrutiny: Part 3
    ... Subject: Security Industry Under Scrutiny: Part 3 ... information that could pose a threat to internet security. ... > So you expect mailing list moderators to be the judge of who deserves what? ... moderators of major mailing lists, or any smaller ones that work really well. ...
    (Full-Disclosure)
  • RE: [Packet-ninjas-syn-k1ck] Anyone know CENZIC?
    ... I don't know anyone that has used them for a pentest, ... mailing lists. ... and web application security testing company. ... This e-mail communication and any ...
    (Pen-Test)
  • Re: remote kernel exploits?
    ... and its pond scum (kiddies, sec mailing lists, etc :-). ... consider the possibility that vulnerabilities in Open Source kernels don't ... in the Security community take a "system-centric" approach to security. ...
    (Incidents)
  • [Full-Disclosure] Security Industry Under Scrutiny: Part 3
    ... > intelligent debate. ... > to improve security then why not implement another measure, ... > think there are two main problems with mailing lists: ... Are you willing to put that trust into the hands of mailing list moderators? ...
    (Full-Disclosure)