Date: Sun, 6 Aug 2000 14:23:16 +0200 (CEST)
From: Martin Schulze joey@finlandia.Infodrom.North.DE
To: Debian Security Announcements
Subject: [Security] Mailman exploitability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Debian Security Advisory security@debian.org
http://www.debian.org/security/ Martin Schulze
August 5, 2000
Package: mailman
Vulnerability: local mailman group exploit
Debian-specific: no
Former versions of mailman v2.0 came with a security problem,
introduced during the 2.0 beta cycle, that could be exploited by
clever local users to gain group mailman permission. No exploit
does exist at the moment, though.
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
Debian GNU/Linux 2.1 alias slink
Slink comes with version 1.0 that is not vulnerable.
Debian 2.2 alias potato
Potato comes with version 1.1 that is not vulnerable.
Debian Unstable alias woody
This version of Debian is not yet released and reflects the
current development release. Fixes are currently available for
Intel ia32 and Motorola 680×0. Fixes for other architectures will
be available soon. In doubt, please recompile the package from
source on your own.
Source archives:
ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5-1.diff.gz
MD5 checksum: 177e666144c35d6b945b30dddf567fef
ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5-1.dsc
MD5 checksum: 431d66e4ef496ce48463ed55193d375c
ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5.orig.tar.gz
MD5 checksum: 2c2602b7745a56adecd4f24fdd6d446f
Intel ia32 architecture:
ftp://ftp.debian.org/debian/dists/woody/main/binary-i386/mail/mailman_2.0beta5-1.deb
MD5 checksum: e2a071bf4a9a3be02978df47ed58acb6
Motorola 680×0 architecture:
ftp://ftp.debian.org/debian/dists/woody/main/binary-m68k/mail/mailman_2.0beta5-1.deb
MD5 checksum: 8bb6367c1e249beaaaa8eb3b7fc71c27
For apt-get: deb http://security.debian.org/
stable updates
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE5jVi0W5ql+IAeqTIRAntHAJ4qPqO9uLQirRFsl48T5Uv729A6/QCfUAiJ
k+20YJsL9L3+SBCkm2KOxic=
=7iAZ
-----END PGP SIGNATURE-----