Mailman 3 January 2003 - Mailman-Developers

list of lists fodder for spammers?
by Greg Westin Jan. 26, 2003

Jan. 26, 2003

Hello Mailman folk, I work with a group that provides services to student groups at a university, and we're concerned that a lot of the lists have been picking up spam lately. The prime suspect, at this point, is Mailman's publishing of list names. If you can provide any input on how to alleviate this problem, please let me know. I'm copying below a message (slightly modified) from one of the more knowledgeable people I work with: --- My real concern with the behavior of the listinfo and admin scripts is that they publish the list of lists not only when invoked without arguments, but also if invoked on a non-existent list name. Because apache can be configured to reject outside of ourdomain.edu or wherever requests for "http://lists.ourdomain.edu/mailman/listinfo", while still allowing "http://lists.ourdomain.edu/mailman/listinfo/hcs-discuss", but what if spammers start generating random list names and sending, e.g., "http://lists.ourdomain.edu/mailman/listinfo/sp4m"? No way to stop such attacks except for Mailman to change its behavior (which the patched version on lists.ourdomain currently does). --- The patched version he's referring to simply denies access to /mailman/listinfo (but not to /mailman/listinfo/valid-list-name) to every request not from our domain. It's an ugly hack, but it's generally fine because students will almost always be working from a university computer, except perhaps when home on vacation. Thanks for any help. Please reply off-list if you're getting this via mailman-developers, as I'm not subscribed to that list. I am on mailman-users, though. Greg Westin -- http://www.gregwestin.com Contact info: http://www.gregwestin.com/contact.php

2 1

Bug in Mailman version 2.1
by Markus Vaara Jan. 26, 2003

Jan. 26, 2003

Bug in Mailman version 2.1 We're sorry, we hit a bug! If you would like to help us identify the problem, please email a copy of this page to the webmaster for this site with a description of what happened. Thanks! Traceback: Traceback (most recent call last): File "/var/mailman/scripts/driver", line 68, in run_main immediate=1) File "/var/mailman/Mailman/Logging/StampedLogger.py", line 52, in __init__ Logger.__init__(self, category, nofail, immediate) File "/var/mailman/Mailman/Logging/Logger.py", line 49, in __init__ self.__get_f() File "/var/mailman/Mailman/Logging/Logger.py", line 67, in __get_f 1) File "/usr/src/build/143041-i386/install/usr/lib/python2.2/codecs.py", line 496, in open file = __builtin__.open(filename, mode, buffering) IOError: [Errno 2] No such file or directory: '/var/log/mailman/error' Python information: Variable Value sys.version 2.2.1 (#1, Aug 30 2002, 12:15:30) [GCC 3.2 20020822 (Red Hat Linux Rawhide 3.2-4)] sys.executable /usr/bin/python sys.prefix /usr sys.exec_prefix /usr sys.path /usr sys.platform linux2 Environment variables: Variable Value PATH_INFO /mailman PYTHONPATH /var/mailman SERVER_SOFTWARE Apache/1.3.27 (Unix) (Red-Hat/Linux) mod_ssl/2.8.12 OpenSSL/0.9.6b DAV/1.0.3 PHP/4.1.2 SCRIPT_FILENAME /var/mailman/cgi-bin/admin SERVER_ADMIN root@localhost SCRIPT_NAME /mailman/admin SERVER_SIGNATURE Apache/1.3.27 Server at vaara.pointclark.net Port 80 REQUEST_METHOD GET HTTP_HOST vaara.pointclark.net HTTP_KEEP_ALIVE 300 SERVER_PROTOCOL HTTP/1.1 QUERY_STRING HTTP_CACHE_CONTROL max-age=0 REQUEST_URI /mailman/admin/mailman HTTP_ACCEPT text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,video/x-mng,image/png,image/jpeg,image/gif;q=0.2,text/css,*/*;q=0.1 HTTP_ACCEPT_CHARSET ISO-8859-1, utf-8;q=0.66, *;q=0.66 HTTP_USER_AGENT Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01 HTTP_CONNECTION keep-alive HTTP_ACCEPT_LANGUAGE fi, en-us;q=0.66, en;q=0.33 PATH_TRANSLATED /var/www/html/mailman SERVER_PORT 80 GATEWAY_INTERFACE CGI/1.1 HTTP_ACCEPT_ENCODING gzip, deflate, compress;q=0.9 DOCUMENT_ROOT /var/www/html

1 0

Re: [ mailman-Patches-674553 ] patch for options.py cross sitescripting bug
by Tokio Kikuchi Jan. 25, 2003

Jan. 25, 2003

Barry, + if not mlist.isMember(user): + if mlist.private_roster: + safeuser = _('<em>undisclosed</em>') This is not a good idea because it will disclose the input email address is not a member. -def loginpage(mlist, doc, user, cgidata): +def loginpage(mlist, doc, user, lang): realname = mlist.real_name actionurl = mlist.GetScriptURL('options') if user is None: title = _('%(realname)s list: member options login page') extra = _('email address and ') else: - title = _('%(realname)s list: member options for user %(user)s') + title = _('%(realname)s list: member options for user %(safeuser)s') Is the name safeuser passed to loginpage()? Sorry for including codes, but I have no time to apply the patch. ;-) SourceForge.net wrote: > Patches item #674553, was opened at 2003-01-25 07:42 > You can respond by visiting: > https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674553&group_i… > (snip) > _______________________________________________ > Mailman-coders mailing list > Mailman-coders(a)python.org > http://mail.python.org/mailman/listinfo/mailman-coders > > -- Tokio Kikuchi, tkikuchi@ is.kochi-u.ac.jp http://weather.is.kochi-u.ac.jp/

1 0

Fw: [ham] Mailman: cross-site scripting bug
by Michael Meltzer Jan. 25, 2003

Jan. 25, 2003

saw this on bugtraq, figuried it was a good idea to relay here. MJM ----- Original Message ----- From: <webmaster(a)procheckup.com> To: <bugtraq(a)securityfocus.com> Sent: Friday, January 24, 2003 9:35 AM Subject: [ham] Mailman: cross-site scripting bug > > > Product: Mailman > Affected Version: 2.1 not other version has been tested > Vendor's URL: http://www.gnu.org/software/mailman/ > Solution: TBC > Author: Manuel Rodriguez > > Introduction: > ------------ > Mailman is software to help manage electronic mail discussion lists, much > like Majordomo or Smartmail. And Mailman have web interface systems. > > > Example: > ----------------- > This is a simple example for version 2.1: > > 1) With mailman options the email variable is vulnerable to cross-site > scripting. > > You can recognise the vulnerabilities with this type of URL: > > https://www.yourserver.com:443/mailman/options/yourlist? > language=en&email=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> > and that prove that any (malicious) script code is possible on web > interface part of Mailman. > > 2) The default error page mailman generates does not adequately filter its > input making it susceptible to cross-site scripting. > > https://www.yourserver.com:443//mailman/options/yourlist? > language=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> >

3 2

senddigests -> LookupError: unknown encoding
by VLists.Net Support Jan. 24, 2003

Jan. 24, 2003

A couple days ago our digests stopped going out automatically. I forced it to run this morning via a special cron entry and received the following report. Can anyone give me a clue as to where to go find out what's happening? Thanks. Traceback (most recent call last): File "/usr/home/circle/usr/local/mailman/cron/senddigests", line 94, in ? main() File "/usr/home/circle/usr/local/mailman/cron/senddigests", line 86, in main mlist.send_digest_now() File "/usr/home/circle/usr/local/mailman/Mailman/Digester.py", line 60, in send_digest_now ToDigest.send_digests(self, mboxfp) File "/usr/home/circle/usr/local/mailman/Mailman/Handlers/ToDigest.py", line 130, in send_digests send_i18n_digests(mlist, mboxfp) File "/usr/home/circle/usr/local/mailman/Mailman/Handlers/ToDigest.py", line 319, in send_i18n_digests b += unicode(t, cset, 'replace').encode(lcset, 'replace') LookupError: unknown encoding

2 3

smtpd.py MailmanProxy port 25 non-root
by Larry Tjoelker Jan. 24, 2003

Jan. 24, 2003

I'm experimenting with smtpd.py MailmanProxy, the version in the current 2.2 distribution. Wondering the best way to listen on port 25 and run as non-root. For now, smtpd.py starts up with the "--nosetuid" option so it can bind to the privileged port, thus starting as root. To let the daemon run as the "mail" user and Enqueue messages with mail user ownership, I added a setuid call in the MailmanProxy class. Any advice how this should have been done? Also, I notice that on my test box qrunner uses the system mail daemon. Is there a configuration that lets qrunner call some python code to deliver list mail? I'm using Mailman 2.08. thanks, larry

1 0

mailmanctl and syslog
by Luigi Rosa Jan. 24, 2003

Jan. 24, 2003

Hello, wouldn't be a good idea to log the start and stop of mailmanctl in the syslog? Something like "Mailman $version services started successfuly" and "Mailman $version services stopped successfuly". Just to leave a trace of the activity in the system log. -- Best regards, Luigi mailto:lrosa@mail.hypertrek.info

3 4

re: 2.1 final - some arch problems
by Andrew D. Clark Jan. 23, 2003

Jan. 23, 2003

Seems like the problem may not actually be with bin/arch, but rather the standard archiving. The list in question currently has a backlog in the archive queue (around 950 files), and the index.html file being generated by the archiving only lists last month (probably because the messages it's currently dealing with are dated Dec 2002). It also takes a fair amount of time (around 1 min or more) to process each message in the archive queue. Even better, it's sticking Jan 22, 2003 messages into the December, 2002 text file. Also, any plans to provide some built-in archive management (limits on age and/or size, etc.) in Mailman? I realize it's not too hard to automate and do via some external script, but it seems like a function that mailman itself should have. -- Andrew Clark Campus Network Programmer Office of Information Technology University of California, Santa Barbara andrew.clark(a)ucsb.edu (805) 893-5311

1 0

2.1 final - some arch problems
by Andrew D. Clark Jan. 23, 2003

Jan. 23, 2003

bin/arch still seems to have trouble with large mbox files (448 MB in this case). It actually does finish processing the archive, which is an improvement over 2.1 betas, but the index.html file that it generated only has a link for one month worth of archives. Another interesting problem is that while a list is being archived (let's say there's a backlog in the arch queue for that list), accessing the admin interface goes into what looks like an endless load (waiting for the lock on the list to be released). While I'll grant that this shouldn't happen too often, it seems that either locking should be done less zealously for things like this, or that the web interface ought to return some useful error, like "List currently locked - try again later". -- Andrew Clark Campus Network Programmer Office of Information Technology University of California, Santa Barbara andrew.clark(a)ucsb.edu (805) 893-5311

1 0

Error detection
by Artur Skura Jan. 23, 2003

Jan. 23, 2003

Hello, I would like to suggest enhancing error detection routines in Mailman. Recently I have experienced a minor file corruption, and the results were a bit frustrating. Although the lists seemed to work fine, neither cron jobs, command-line tool nor WWW interface would. The cryptic message I got was always ending with: $ ./checkdbs Traceback (most recent call last): File "./checkdbs", line 136, in ? main() File "./checkdbs", line 55, in main mlist = MailList.MailList(name) File "/usr/lib/mailman/Mailman/MailList.py", line 99, in __init__ self.Lock() File "/usr/lib/mailman/Mailman/MailList.py", line 149, in Lock self.Load() File "/usr/lib/mailman/Mailman/MailList.py", line 573, in Load dict, e = self.__load(file) File "/usr/lib/mailman/Mailman/MailList.py", line 546, in __load dict = loadfunc(fp) cPickle.UnpicklingError: unpickling stack underflow It took a while to find out where I should look for the error. I examined the value of fp, then checked out databases in list directories and found out one of config.pck's was corrupted. I overwrote it with config.pck.last and everything started to work fine. Maybe something could be done to give the user the cause of thje error in a more explicit way? I thought Mailman should open config.pck.last automatically if config.pck is corrupted. Best Regards, Artur -- http://www.amnesty.org.pl

1 0