Vulnerability-Lookup

CERTA-2006-AVI-146

Vulnerability from certfr_avis - Published: - Updated:

None

Description

Mailman est un gestionnaire de listes de diffusion.

Une vulnérabilité est présente dans l'outil Mailman. Un utilisateur mal intentionné peut utiliser cette vulnérabilité pour réaliser une attaque de type « CROSS SITE SCRIPTING ».

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Mailman versions 2.x antérieures à la version 2.1.8.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

CVE-2006-0052 (GCVE-0-2006-0052)

Vulnerability from cvelistv5 – Published: 2006-03-31 11:00 – Updated: 2024-08-07 16:18

Summary

The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary.

Severity ?

No CVSS data available.

CWE

Assigner

debian

References

URL

Tags

	http://secunia.com/advisories/19522	third-party-advisoryx_refsource_SECUNIA
	http://secunia.com/advisories/20782	third-party-advisoryx_refsource_SECUNIA
	https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
	http://www.securityfocus.com/bid/17311	vdb-entryx_refsource_BID
	http://secunia.com/advisories/20624	third-party-advisoryx_refsource_SECUNIA
	ftp://patches.sgi.com/support/free/security/advis…	vendor-advisoryx_refsource_SGI
	http://www.debian.org/security/2006/dsa-1027	vendor-advisoryx_refsource_DEBIAN
	http://www.redhat.com/support/errata/RHSA-2006-04…	vendor-advisoryx_refsource_REDHAT
	http://www.novell.com/linux/security/advisories/2…	vendor-advisoryx_refsource_SUSE
	http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358892	x_refsource_CONFIRM
	http://securitytracker.com/id?1015851	vdb-entryx_refsource_SECTRACK
	http://secunia.com/advisories/19545	third-party-advisoryx_refsource_SECUNIA
	http://secunia.com/advisories/19571	third-party-advisoryx_refsource_SECUNIA
	https://usn.ubuntu.com/267-1/	vendor-advisoryx_refsource_UBUNTU
	http://www.osvdb.org/24367	vdb-entryx_refsource_OSVDB

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:18:20.931Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "19522",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19522"
          },
          {
            "name": "20782",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/20782"
          },
          {
            "name": "oval:org.mitre.oval:def:9475",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9475"
          },
          {
            "name": "17311",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/17311"
          },
          {
            "name": "20624",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/20624"
          },
          {
            "name": "20060602-01-U",
            "tags": [
              "vendor-advisory",
              "x_refsource_SGI",
              "x_transferred"
            ],
            "url": "ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc"
          },
          {
            "name": "DSA-1027",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2006/dsa-1027"
          },
          {
            "name": "RHSA-2006:0486",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0486.html"
          },
          {
            "name": "SUSE-SR:2006:008",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2006_08_sr.html"
          },
          {
            "name": "MDKSA-2006:061",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:061"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358892"
          },
          {
            "name": "1015851",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1015851"
          },
          {
            "name": "19545",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19545"
          },
          {
            "name": "19571",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19571"
          },
          {
            "name": "USN-267-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/267-1/"
          },
          {
            "name": "24367",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/24367"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-03-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python\u0027s library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-03T20:57:01",
        "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
        "shortName": "debian"
      },
      "references": [
        {
          "name": "19522",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19522"
        },
        {
          "name": "20782",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/20782"
        },
        {
          "name": "oval:org.mitre.oval:def:9475",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9475"
        },
        {
          "name": "17311",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/17311"
        },
        {
          "name": "20624",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/20624"
        },
        {
          "name": "20060602-01-U",
          "tags": [
            "vendor-advisory",
            "x_refsource_SGI"
          ],
          "url": "ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc"
        },
        {
          "name": "DSA-1027",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2006/dsa-1027"
        },
        {
          "name": "RHSA-2006:0486",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2006-0486.html"
        },
        {
          "name": "SUSE-SR:2006:008",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2006_08_sr.html"
        },
        {
          "name": "MDKSA-2006:061",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:061"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358892"
        },
        {
          "name": "1015851",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1015851"
        },
        {
          "name": "19545",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19545"
        },
        {
          "name": "19571",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19571"
        },
        {
          "name": "USN-267-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/267-1/"
        },
        {
          "name": "24367",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/24367"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@debian.org",
          "ID": "CVE-2006-0052",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python\u0027s library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "19522",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/19522"
            },
            {
              "name": "20782",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/20782"
            },
            {
              "name": "oval:org.mitre.oval:def:9475",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9475"
            },
            {
              "name": "17311",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/17311"
            },
            {
              "name": "20624",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/20624"
            },
            {
              "name": "20060602-01-U",
              "refsource": "SGI",
              "url": "ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc"
            },
            {
              "name": "DSA-1027",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2006/dsa-1027"
            },
            {
              "name": "RHSA-2006:0486",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2006-0486.html"
            },
            {
              "name": "SUSE-SR:2006:008",
              "refsource": "SUSE",
              "url": "http://www.novell.com/linux/security/advisories/2006_08_sr.html"
            },
            {
              "name": "MDKSA-2006:061",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:061"
            },
            {
              "name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358892",
              "refsource": "CONFIRM",
              "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358892"
            },
            {
              "name": "1015851",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1015851"
            },
            {
              "name": "19545",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/19545"
            },
            {
              "name": "19571",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/19571"
            },
            {
              "name": "USN-267-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/267-1/"
            },
            {
              "name": "24367",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/24367"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
    "assignerShortName": "debian",
    "cveId": "CVE-2006-0052",
    "datePublished": "2006-03-31T11:00:00",
    "dateReserved": "2005-12-28T00:00:00",
    "dateUpdated": "2024-08-07T16:18:20.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted