SMTP: Mailman Password Disclosure

This signature detects attempts to exploit a known vulnerability in Mailman, a free application for managing e-mail discussion and e-newsletter lists. If they know the e-mail address of a subscriber on a mailing list administered by Mailman, attackers can obtain the password for that subscriber.

Extended Description

Mailman is prone to an unspecified password retrieval vulnerability. This vulnerability was disclosed by the vendor. Reportedly, a remote attacker can gain access to user passwords, when the users subscribe to a mailing list. A remote attacker can use the sensitive information to hijack user accounts or carry out other attacks. Further information about this issue states that to exploit this vulnerability an attacker does not need to be subscribed to the list. The attacker needs to be able to mail -request@ and know the email address of a user to disclose the user's password. It is reported this issue affects Mailman 2.1.x versions. Due to a lack of details further information is not available at the moment. This BID will be updated as more information becomes available.

Affected Products

Gnu mailman

References

BugTraq: 10412

CVE: CVE-2004-0412

URL: http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html http://xforce.iss.net/xforce/xfdb/16256

Short Name

SMTP:MAILMAN:PASSWD-DISCLOSURE

Severity

Minor

Recommended

False

Recommended Action

None

SMTP: Mailman Password Disclosure

Extended Description

Affected Products

References

Found a potential security threat?