PT-2006-5409 · Gnu+1 · Mailman+1

Moritz Naumann · Published 2006-09-07 · Updated 2018-10-17 · CVE-2006-4624

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mailman versions prior to 2.1.9rc1

Description The issue is related to a CRLF injection vulnerability in the Utils.py file. This vulnerability allows remote attackers to inject CRLF sequences into the URI, potentially spoofing messages in the error log. Attackers may use this to trick administrators into visiting malicious URLs.

Recommendations For versions prior to 2.1.9rc1, update to version 2.1.9rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to the error log to minimize the risk of exploitation. Avoid using URLs with CRLF sequences in the affected Mailman version until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2006-4624

DSA-1188-1

RHSA-2007:0779

RHSA-2007_0779

Affected Products

Mailman

Red Hat

References · 25

• http://secunia.com/advisories/27669 · Vendor Advisory
• http://secunia.com/advisories/22639 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_25_sr.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:165 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4624 · Security Note
• http://debian.org/security/2006/dsa-1188 · Vendor Advisory
• http://secunia.com/advisories/22020 · Vendor Advisory
• http://secunia.com/advisories/22227 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0779.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200609-12.xml · Vendor Advisory
• http://secunia.com/advisories/22011 · Vendor Advisory
• http://secunia.com/advisories/21732 · Vendor Advisory
• http://sourceforge.net/project/shownotes.php?group_id=103&release_id=444295 · Patch
• http://securityfocus.com/bid/19831 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9756 · Note