A previously unknown vulnerability in Mailman, a popular open-source program for managing mailing lists, has led to the theft of the password file for a well-known security discussion group.
The theft, discovered this week and reported in an announcement to the Full Disclosure security mailing list on Wednesday, casts uncertainty on the security of other discussion groups that use the open-source Mailman package. By specially crafting a Web address, an attacker can obtain the password for every member of a discussion group.
"Anyone with a Web browser can download a file off a vulnerable system--it's (easy to do)," said John Cartwright, co-founder and manager of the Full Disclosure mailing list. The attack, known as a remote directory traversal exploit, occurred on Jan. 2, according to Cartwright's investigation. "As far as our server goes, there is no evidence that any other files were accessed using this flaw."
The flaw could have far-reaching consequences because some mailing list subscribers change their access code to a password that they reuse elsewhere. Since Mailman uses subscribers' e-mail as their user name, people who reuse passwords could put other accounts in jeopardy.
"In any event, the safest approach is to assume the worst, and it is recommended that you apply this Mailman patch as soon as possible," the advisory stated.
The Full Disclosure discussion list had used Mailman running on Apache 1.3, a vulnerable configuration.
Companies and projects that distributed Mailman as part of their Linux distribution have already started releasing fixes for the problem. Debian, Ubuntu and Gentoo Linux have released advisories citing the problem and offering patches.
Join the conversation
Comment replyThe posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.
Google creates an animated doodle that features a boy, a girl, Google's search engine, and a jump rope. But might there be darker, more analytical, more troubling interpretations to this tale?
The Silicon Valley online payments startup grew by 1,000 percent last year and is hopeful it can repeat that level of growth this year. To do that, it's had to move away from its early friends-and-family roots and embrace small businesses.
Chamtech's spray-on antenna uses a nano material to provide a low-power boost to antenna range. The wireless-in-a-can product may some day bring an end to unsightly cell towers.
EnerG2 opens a plant to make an engineered carbon that will improve performance of energy storage devices and make storage for start-stop hybrid cars less expensive.
Join the conversation