[7620] in SIPB bug reports
Exmh bug
daemon@ATHENA.MIT.EDU (Kev)
Mon Aug 7 10:31:08 2000
Message-Id: <200008071426.KAA18352@multics.mit.edu>
To: bug-sipb@MIT.EDU
Date: Mon, 07 Aug 2000 10:26:00 -0400
From: Kev <klmitch@MIT.EDU>
The following message causes exmh to display the following text:
This is a application/pgp
It might be displayable with metamail. (Invoke menu with right button.)
format = text
x-action = sign
Right-clicking and turning off "Decode part as MIME" properly displays
the message. Note that I have exmh configured such that "Decode part
as MIME" is supposed to always be off; I have no idea why it insists on
turning this feature on against my wishes and my explicit configuration.
I gotta switch to rmail or something.
------- Forwarded Message
Return-Path: <owner-bugtraq@SECURITYFOCUS.COM>
Received: from MIT.EDU by po12.mit.edu (8.9.2/4.7) id EAA16432; Mon, 7 Aug 2000 04:15:16 -0400 (EDT)
Received: from lists.securityfocus.com by MIT.EDU with SMTP
id AA04107; Mon, 7 Aug 00 04:13:55 EDT
Received: from lists.securityfocus.com (lists.securityfocus.com [207.126.127.68])
by lists.securityfocus.com (Postfix) with ESMTP
id 88B281FB76; Mon, 7 Aug 2000 00:05:12 -0700 (PDT)
Received: from LISTS.SECURITYFOCUS.COM by LISTS.SECURITYFOCUS.COM
(LISTSERV-TCP/IP release 1.8d) with spool id 11324362 for
BUGTRAQ@LISTS.SECURITYFOCUS.COM; Mon, 7 Aug 2000 00:04:21 -0700
Approved-By: aleph1@SECURITYFOCUS.COM
Delivered-To: bugtraq@lists.securityfocus.com
Received: from securityfocus.com (mail.securityfocus.com [207.126.127.78]) by
lists.securityfocus.com (Postfix) with SMTP id E99331EE8D for
<bugtraq@lists.securityfocus.com>; Sun, 6 Aug 2000 05:26:19 -0700
(PDT)
Received: (qmail 18517 invoked by alias); 6 Aug 2000 12:27:03 -0000
Delivered-To: bugtraq@securityfocus.com
Received: (qmail 18514 invoked from network); 6 Aug 2000 12:27:03 -0000
Received: from murphy.debian.org (216.234.231.6) by mail.securityfocus.com with
SMTP; 6 Aug 2000 12:27:03 -0000
Received: (qmail 3048 invoked by uid 38); 6 Aug 2000 12:23:20 -0000
X-Envelope-Sender: joey@finlandia.Infodrom.North.DE
Received: (qmail 3006 invoked from network); 6 Aug 2000 12:23:19 -0000
Received: from kuolema.infodrom.north.de (postfix@195.27.69.163) by
murphy.debian.org with SMTP; 6 Aug 2000 12:23:19 -0000
Received: from finlandia.Infodrom.North.DE (finlandia.Infodrom.North.DE
[195.27.69.162]) by kuolema.infodrom.north.de (Postfix) with ESMTP id
723BE146E7D for <debian-security-announce@lists.debian.org>; Sun, 6
Aug 2000 14:19:23 +0200 (CEST)
Received: at Infodrom Oldenburg (/\##/\ Smail-3.2.0.102 1998-Aug-2 #2) by
finlandia.Infodrom.North.DE via sendmail from stdin id
<m13LPSW-000alUC@finlandia.Infodrom.North.DE> for
debian-security-announce@lists.debian.org; Sun, 6 Aug 2000 14:23:16
+0200 (CEST)
Content-Type: application/pgp; format=text; x-action=sign
X-Debian: PGP check passed for security officers
Priority: urgent
X-Mailing-List: <debian-security-announce@lists.debian.org> archive/latest/106
X-Loop: debian-security-announce@lists.debian.org
Precedence: list
Message-Id: <kK1VsC.A.fv.4iVj5@murphy>
Date: Sun, 6 Aug 2000 05:26:19 -0700
Reply-To: security@debian.org
Sender: Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM>
Comments: Resent-From: debian-security-announce@lists.debian.org
Comments: Originally-From: joey@finlandia.Infodrom.North.DE (Martin Schulze)
From: debian-security-announce@LISTS.DEBIAN.ORG
Subject: [Security] Mailman exploitability
To: BUGTRAQ@SECURITYFOCUS.COM
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ----------------------------------------------------------------------------
Debian Security Advisory security@debian.org
http://www.debian.org/security/ Martin Schulze
August 5, 2000
- - ----------------------------------------------------------------------------
Package: mailman
Vulnerability: local mailman group exploit
Debian-specific: no
Former versions of mailman v2.0 came with a security problem,
introduced during the 2.0 beta cycle, that could be exploited by
clever local users to gain group mailman permission. No exploit does
exist at the moment, though.
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
Debian GNU/Linux 2.1 alias slink
- - --------------------------------
Slink comes with version 1.0 that is not vulnerable.
Debian 2.2 alias potato
- - -----------------------
Potato comes with version 1.1 that is not vulnerable.
Debian Unstable alias woody
- - ---------------------------
This version of Debian is not yet released and reflects the current
development release. Fixes are currently available for Intel ia32
and Motorola 680x0. Fixes for other architectures will be available
soon. In doubt, please recompile the package from source on your
own.
Source archives:
ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5-1.diff.gz
MD5 checksum: 177e666144c35d6b945b30dddf567fef
ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5-1.dsc
MD5 checksum: 431d66e4ef496ce48463ed55193d375c
ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5.orig.tar.gz
MD5 checksum: 2c2602b7745a56adecd4f24fdd6d446f
Intel ia32 architecture:
ftp://ftp.debian.org/debian/dists/woody/main/binary-i386/mail/mailman_2.0beta5-1.deb
MD5 checksum: e2a071bf4a9a3be02978df47ed58acb6
Motorola 680x0 architecture:
ftp://ftp.debian.org/debian/dists/woody/main/binary-m68k/mail/mailman_2.0beta5-1.deb
MD5 checksum: 8bb6367c1e249beaaaa8eb3b7fc71c27
- - ----------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable updates
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE5jVi0W5ql+IAeqTIRAntHAJ4qPqO9uLQirRFsl48T5Uv729A6/QCfUAiJ
k+20YJsL9L3+SBCkm2KOxic=
=7iAZ
- -----END PGP SIGNATURE-----
- --
To UNSUBSCRIBE, email to debian-security-announce-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
------- End of Forwarded Message
--
Kevin L. Mitchell <klmitch@mit.edu>
