<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd" >
<html>
<!-- THIS PAGE IS AUTOMATICALLY GENERATED. DO NOT EDIT. -->
<!-- Thu Feb 24 10:23:20 2005 -->
<!-- USING HT2HTML 2.0 -->
<!-- SEE http://ht2html.sf.net -->
<!-- User-specified headers:
Title: Mailman security issues
-->
<head>
<title>Mailman security issues</title>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii" >
<meta name="generator" content="HT2HTML/2.0" >
<style type="text/css">
body { margin: 0px; }
</style>
</head>
<body bgcolor="#ffffff" text="#000000"
marginwidth="0" marginheight="0"
link="#0000bb" vlink="#551a8b"
alink="#ff0000">
<!-- start of page table -->
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<!-- start of banner row -->
<tr>
<!-- start of corner cells -->
<td width="150" valign="middle" bgcolor="white" class="corner">
<center>
<a href="./index.html">
<img border=0 src="./images/logo-70.jpg"></a></center> </td>
<td width="15" bgcolor="#eecfa1"> </td><!--spacer-->
<!-- end of corner cells -->
<!-- start of banner -->
<td width="90%" bgcolor="#eecfa1" class="banner">
<!-- start of site links table -->
<table width="100%" border="0"
CELLSPACING=0 CELLPADDING=0
bgcolor="#ffffff">
<tr>
<td bgcolor="#eecfa1">
<a href="./index.html">Home</a>
</td>
<td bgcolor="#eecfa1">
<b>Security</b>
</td>
<td bgcolor="#eecfa1">
<a href="./docs.html">Documentation</a>
</td>
<td bgcolor="#eecfa1">
<a href="./lists.html">Mailing lists</a>
</td>
</tr><tr>
<td bgcolor="#eecfa1">
</td>
<td bgcolor="#eecfa1">
<a href="./help.html">Help</a>
</td>
<td bgcolor="#eecfa1">
<a href="./download.html">Download</a>
</td>
<td bgcolor="#eecfa1">
<a href="./devs.html">Developers</a>
</td>
</tr>
</table><!-- end of site links table -->
</td><!-- end of banner -->
</tr><!-- end of banner row -->
<tr><!-- start of sidebar/body row -->
<!-- start of sidebar cells -->
<td width="150" valign="top" bgcolor="#eecfa1" class="sidebar">
<!-- start of sidebar table -->
<table width="100%" border="0" cellspacing="0" cellpadding="3"
bgcolor="#ffffff">
<tr><td bgcolor="#36648b"><b><font color="#ffffff">
Overview
</font></b></td></tr>
<tr><td bgcolor="#eecfa1">
<a href="index.html">Home</a>
</td></tr>
<tr><td bgcolor="#eecfa1">
<a href="security.html">Security</li>
</td></tr>
<tr><td bgcolor="#eecfa1">
<a href="features.html">Features</a>
</td></tr>
<tr><td bgcolor="#eecfa1">
<a href="i18n.html">Internationalization</a>
</td></tr>
<tr><td bgcolor="#eecfa1">
<a href="otherstuff.html">Rants, Papers, and Logos</a>
</td></tr>
<tr><td bgcolor="#eecfa1">
<a href="inthenews.html">Mailman in Use</a>
</td></tr>
<tr><td bgcolor="#eecfa1">
<a href="prev.html">Previous Releases</a>
</td></tr>
<tr><td bgcolor="#eecfa1">
<a href="bugs.html">Bugs and Patches</a>
</td></tr>
<tr><td bgcolor="#eecfa1">
<a href="mirrors.html">Mirrors</a>
</td></tr>
<tr><td bgcolor="#eecfa1"> </td></tr>
<tr><td bgcolor="#36648b"><b><font color="#ffffff">
Exits
</font></b></td></tr>
<tr><td bgcolor="#eecfa1">
<a href="http://sf.net/projects/mailman">SF Project Page</a>
</td></tr>
<tr><td bgcolor="#eecfa1">
<a href="lists.html">Discussion Lists</a>
</td></tr>
<tr><td bgcolor="#eecfa1">
<a href="http://www.python.org/">Python</a>
</td></tr>
<tr><td bgcolor="#eecfa1">
<a href="http://www.gnu.org/">GNU</a>
</td></tr>
<tr><td bgcolor="#eecfa1">
<a href="http://barry.warsaw.us/">Barry Warsaw</a>
</td></tr>
<tr><td bgcolor="#eecfa1"> </td></tr>
<tr><td bgcolor="#36648b"><b><font color="#ffffff">
Email Us
</font></b></td></tr>
<tr><td bgcolor="#eecfa1">
<a href="mailto:mailman-users@python.org">mailman-users@python.org</a>
</td></tr>
<tr><td bgcolor="#eecfa1">
</td></tr>
<tr><td bgcolor="#eecfa1">
<a href="http://www.python.org/"><img border=0
src="./images/PythonPoweredSmall.png"
></a> <a href="http://sourceforge.net"><img
src="http://sourceforge.net/sflogo.php?group_id=103"
width="88" height="31" border="0"
alt="SourceForge Logo"></a>
</td></tr>
<tr><td bgcolor="#eecfa1">
</td></tr>
<tr><td bgcolor="#eecfa1">
© 1998-2005
Free Software Foundation, Inc. Verbatim copying and distribution of this
entire article is permitted in any medium, provided this notice is preserved.
</td></tr>
</table><!-- end of sidebar table -->
</td>
<td width="15"> </td><!--spacer-->
<!-- end of sidebar cell -->
<!-- start of body cell -->
<td valign="top" width="90%" class="body"><br>
<h3>Mailman security issues</h3>
The GNU Mailman developers take security very seriously. All Mailman security
concerns should be emailed to
<a href="mailto:%6D%61%69%6C%6D%61%6E%2D%73%65%63%75%72%69%74%79%40%70%79%74%68%6F%6E%2E%6F%72%67">mailman-security at python dot org</a>.
This is a closed list that reaches the core Mailman developers.
<h3>Known issues and fixes</h3>
<ul>
<li><b>CAN-2005-0202</b> -- This is a very serious issue affecting the Mailman
2.1 series up to and including version 2.1.5. Mailman 2.1.6 is not
affected. This issue can allow for the leakage of member passwords.
<p>A quick, immediate fix is to remove the /usr/local/mailman/cgi-bin/private
executable. However, this will break any private archives your lists may be
using. See below for a proper patch.
<p>The extent of your exposure to this vulnerability depends on factors such
as which version of Apache you are running and how you have it configured. We
do not currently know the exact combination that enables the hole, although we
currently believe that Apache 2.0 sites are not vulnerable and that that many
if not most Apache 1.3 sites are vulnerable. In any event, the safest
approach is to assume the worst and it is recommended that you apply
<a href="CAN-2005-0202.txt">this Mailman patch</a> as soon as possible.
<p>For additional peace of mind, it is
recommended that you regenerate your list member passwords using
<a href="reset_pw.py">the Mailman 2.1.6 reset_pw.py script</a>. Put this file
in your Mailman installation's bin directory. After running the script, you
might also want to manually run the cron/mailpasswds script so that your users
will be informed of their new passwords.
<p>Credit goes to Marcus Meissner for finding this issue.
</li>
</ul>
</td><!-- end of body cell -->
</tr><!-- end of sidebar/body row -->
</table><!-- end of page table -->
</body></html>