1. Forum
  2. Usenet
  3. LINUX.DEBIAN.BUGS.DIST

  • Bug#260508: sympa: Reported to the security team?

    From Kjetil Kjernsmo@1:229/2 to All on Thu Aug 12 19:20:04 2004
    From: [email protected]

    Package: sympa
    Severity: grave
    Tags: security, fixed-upstream
    Followup-For: Bug #260508

    I was wondering if this problem has been reported to the security team? Shouldn't it?

    I assume that the problem that is referred to is this:
    "Listmaster approval could be bypassed to create a list. This
    vulnerability affects all 2.x, 3.x and 4.x Sympa versions."

    This means that all sympa packages in Debian are vulnerable, and I guess
    it is appropriate to mark this bug accordingly. I'm not experienced
    enought with the BTS to know if setting the pseudo-headers will do the
    trick, but it is worth a shot.

    -- System Information:
    Debian Release: testing/unstable
    APT prefers testing
    APT policy: (990, 'testing')
    Architecture: i386 (i686)
    Kernel: Linux 2.6.7-ruby.2004-07-25.owl.1.oss
    Locale: LANG=C, LC_CTYPE=C


    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Stefan Hornburg@1:229/2 to Kjetil Kjernsmo on Fri Aug 13 13:30:11 2004
    From: [email protected]

    On Thu, 12 Aug 2004 18:54:17 +0200
    Kjetil Kjernsmo <[email protected]> wrote:

    Package: sympa
    Severity: grave
    Tags: security, fixed-upstream
    Followup-For: Bug #260508

    I was wondering if this problem has been reported to the security team? Shouldn't it?

    I assume that the problem that is referred to is this:
    "Listmaster approval could be bypassed to create a list. This
    vulnerability affects all 2.x, 3.x and 4.x Sympa versions."

    This means that all sympa packages in Debian are vulnerable, and I guess
    it is appropriate to mark this bug accordingly. I'm not experienced
    enought with the BTS to know if setting the pseudo-headers will do the
    trick, but it is worth a shot.

    Sounds reasonable, I'll address the problem ASAP.

    Thanks
    Racke


    --
    LinuXia Systems => http://www.linuxia.de/
    Expert Interchange Consulting and System Administration
    ICDEVGROUP => http://www.icdevgroup.org/
    Interchange Development Team



    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)