Mailman 3 August 2000 - Mailman-Users

Upgrade problem
by Aaryn Olsson Aug. 2, 2000

Aug. 2, 2000

Dear mailman-users, I apologize for not giving more information in my last, panicked message. The problem seems to be that there is a reference to the old mailman-1.1 somewhere within the mailman-2.0 framework. There are no references to mailman-1.1 anywhere in the aliases files, nor in the passwd file. In my last message I asked why would members of a list be receiving endless digest messages. In the logs/error file, there are over 20,000 messages (each 20 lines each) indicating that … [View More]

2 1

Advisory: mailman local compromise (fwd)
by Trevor Johnson Aug. 1, 2000

Aug. 1, 2000

---------- Forwarded message ---------- Date: Tue, 1 Aug 2000 13:14:20 -0400 From: Stan Bubrouski <secnet(a)CROSSWINDS.NET> To: BUGTRAQ(a)SECURITYFOCUS.COM Subject: Advisory: mailman local compromise Author : Stan Bubrouski Date : August 1, 2000 Package : mailman Versions affected : 2.0beta3 (released: 2000-Jun-28 23:25) 2.0beta4 (released: 2000-Jul-06 21:27) Severity : access to group mailman … [View More]binaries are installed as which (usually mailman). Most directories in a mailman install are mode 2755 as are most of the binaries and scripts. Many configurations are 664 allowing a local user to change list ocnfigurations and even read the adm.pw passwd file. Additionally besides being able to read public and private data along with passwds, a malicious user could replace binaries and scripts in a mailman installation because they are writable by group mailman. Problem : The mailman package comes with a sgid program named wrapper. This program contains a function named fatal() which is used to display error messages. Unfortunately it fails to send the correct amount of arguments to the fprintf(3) function allowing users to add formatting which could be used to insert and execute code under group mailman. fatal() is called when invalid arguments are provided and in such a case, the invalid arguments are sent to fprintf without being formatted, the same goes for argv[0]. Example: [user@king user]$ ls -al /usr/share/mailman/mail/wrapper -rwxr-sr-x 1 mailman mailman 36290 Jul 1 06:48 /usr/share/mailman/mail/wrapper [user@king user]$ cd /usr/share/mailman/mail [user@king mail]$ ls -al total 39 drwxrwsr-x 2 mailman mailman 1024 Jul 12 19:29 . drwxrwsr-x 16 mailman mailman 1024 Jul 27 20:13 .. -rwxr-sr-x 1 mailman mailman 36290 Jul 1 06:48 wrapper [user@king mail]$ ./wrapper Usage: ./wrapper program [args...] [user@king mail]$ ./wrapper %s Illegal command: Illegal command: %s[user@king mail]$ ./wrapper %s%s Illegal command: Illegal command: %s%s��=@��X��>@[user@king mail]$ ./wrapper %s%s%s Segmentation fault [user@king mail]$ ./wrapper %s%u%p Illegal command: Illegal command: %s%u%p32212244600x656c6c49[user@king mail]$ [user@king mail]$ doexec ./wrapper %s Usage: Usage: %s program [args...] program [args...] [user@king mail]$ doexec ./wrapper %s%s Usage: Usage: %s%s program [args...] ��=@��X��>@ program [args...] [user@king mail]$ doexec ./wrapper %s%p Usage: Usage: %s%p program [args...] 0xbffffc0c program [args...] [user@king mail]$ doexec ./wrapper %s%S%u Usage: Usage: %s%S%u program [args...] [user@king mail]$ doexec ./wrapper %s%s Usage: Usage: %s%s program [args...] ��=@��X��>@ program [args...] [user@king mail]$ doexec ./wrapper %s%s%s Segmentation fault [user@king mail]$ Patch: diff -u -r ./cgi-wrapper.c.orig ./cgi-wrapper.c --- ./cgi-wrapper.c.orig Tue Mar 21 01:26:41 2000 +++ ./cgi-wrapper.c Fri Jul 28 00:17:42 2000 @@ -53,7 +53,7 @@ fake_argv[2] = script; status = run_script("driver", 3, fake_argv, env); - fatal(logident, status, "%s", strerror(errno)); + fatal(logident, status, "%s\n", strerror(errno)); return status; } diff -u -r common.c.orig ./common.c --- ./common.c.orig Mon May 22 14:59:31 2000 +++ ./common.c Thu Jul 27 23:58:12 2000 @@ -108,7 +108,7 @@ printf("</pre>\n"); } else - fprintf(stderr, log_entry); + fprintf(stderr, "%s", log_entry); #endif /* HELPFUL */ exit(exitcode); } diff -u -r ./mail-wrapper.c.orig ./mail-wrapper.c --- ./mail-wrapper.c.orig Tue Mar 21 01:26:41 2000 +++ ./mail-wrapper.c Fri Jul 28 00:16:34 2000 @@ -67,13 +67,13 @@ if (!check_command(argv[1])) fatal(logident, MAIL_ILLEGAL_COMMAND, - "Illegal command: %s", argv[1]); + "Illegal command: %s\n", argv[1]); check_caller(logident, parentgid); /* If we got here, everything must be OK */ status = run_script(argv[1], argc, argv, env); - fatal(logident, status, "%s", strerror(errno)); + fatal(logident, status, "%s\n", strerror(errno)); return status; } Patch info : The patch fixes fatal() and also adds newlines to some fatal() calls because fatal() does not tack them on and as you can see in the example above, the lack of newlines in some calls make errors harder to read. I made the patch using the latest CVS tree but it should apply to beta3 and beta4 releases as well. [View Less]

1 0

access via https, some links use http
by Andreas Hasenack Aug. 1, 2000

Aug. 1, 2000

I'm using mailman 2.0beta4 and I like to use the administrative pages via https rather than via http. It works, no problem with that. But some links in the pages have http://... hardcoded in them, for example, the membership management one. If I want to see next page of subscribed users, using the link gets me back to non-SSL. To use them, now I just paste them in the URL location in the browser and change http to https. Is there anyway those links could use what I am using at that moment, http … [View More]

4 3

Re: Ag.Arizona.Edu mailing list memberships reminder (fwd)
by Aaryn Olsson Aug. 1, 2000

Aug. 1, 2000

Dear mailman-users, Is this possible for this list subscriber? Thanks, Aaryn Olsson ---------- Forwarded message ---------- Date: Tue, 1 Aug 2000 08:10:13 -0700 (MST) From: Kelly LeFevre <krl(a)U.Arizona.EDU> To: mailman-owner(a)Ag.Arizona.Edu Subject: Re: Ag.Arizona.Edu mailing list memberships reminder Can I turn off this monthly reminder? Can I do so for the entire membership of a list? Thanks. Kelly LeFevre GSO list owner On Tue, 1 Aug 2000 mailman-owner(a)Ag.Arizona.Edu wrote: … [View More]

2 1

Beta5 or final?
by Gregory Leblanc Aug. 1, 2000

Aug. 1, 2000

Barry posted something about hoping to have a final beta or even a "stable" release out by a week after the O'Reilly conference. Anybody heard anything with regards to this? Greg P.S. Sorry to nag, but I'm putting a server in at work "real soon now", and I'd love to be able to run "stable" code, just so that it doesn't say "beta". :-)

1 0

urgent - digest out of control
by Aaryn Olsson Aug. 1, 2000

Aug. 1, 2000

Dear mailman-users, There seems to be a digest out of control. The email I received earlier indicated over 100 messages, but the last message from an unhappy user indicated he had received over 800, so it looks like it's still going. What would cause users to receive endless copies of a message like this? TIA, Aaryn ---------- Forwarded message ---------- Date: Tue, 01 Aug 2000 08:53:17 -0700 From: Kathleen Peterson <kpetersn(a)Ag.Arizona.Edu> To: lab(a)Ag.Arizona.Edu Subject: Fwd: … [View More]Arid_gardener digest, Vol 1 #1044 - 14 msgs >Return-Path: <arid_gardener-admin(a)Ag.Arizona.Edu> >Received: from post1.inre.asu.edu (post1.inre.asu.edu [129.219.13.100]) > by Ag.Arizona.Edu (8.9.3+Sun/8.9.3) with ESMTP id IAA10708 > for <kpetersn(a)Ag.Arizona.Edu>; Tue, 1 Aug 2000 08:28:34 -0700 (MST) >Received: from conversion.post1.inre.asu.edu by asu.edu (PMDF V5.2-31 #33824) > id <0FYM00K01DNIMD(a)asu.edu> for kpetersn(a)Ag.Arizona.Edu > (ORCPT rfc822;kathyp(a)asu.edu); Tue, 1 Aug 2000 08:28:31 -0700 (MST) >Received: from smtp.asu.edu (smtp.asu.edu [129.219.13.92]) > by asu.edu (PMDF V5.2-31 #33824) with ESMTP id <0FYM00B9NDNGVU(a)asu.edu> for > kpetersn(a)Ag.Arizona.Edu (ORCPT rfc822;kathyp(a)asu.edu); Tue, > 01 Aug 2000 08:28:30 -0700 (MST) >Received: from imap4.asu.edu (imap4.asu.edu [129.219.10.161]) > by smtp.asu.edu (8.9.3/8.9.3) with ESMTP id IAA24219 for > <kpetersn(a)Ag.Arizona.Edu>; Tue, 01 Aug 2000 08:28:32 -0700 (MST) >Received: from post3.inre.asu.edu (post3.inre.asu.edu [129.219.13.74]) > by imap4.asu.edu (8.9.3/8.9.1) with ESMTP id IAA25831 for > <kathyp(a)IMAP4.ASU.EDU>; Tue, 01 Aug 2000 08:28:21 -0700 (MST) >Received: from conversion.post3.inre.asu.edu by asu.edu (PMDF V5.2-31 #33824) > id <0FYM00K01DPGZC(a)asu.edu> for kathyp(a)IMAP4.ASU.EDU > (ORCPT rfc822;kathyp(a)asu.edu); Tue, 01 Aug 2000 08:29:40 -0700 (MST) >Received: from Ag.Arizona.Edu (AG.Arizona.EDU [128.196.42.70]) > by asu.edu (PMDF V5.2-31 #33824) with ESMTP id <0FYM00MIZDPFUK(a)asu.edu> for > kathyp(a)IMAP4.ASU.EDU (ORCPT rfc822;kathyp(a)asu.edu); Tue, > 01 Aug 2000 08:29:40 -0700 (MST) >Received: from Ag.Arizona.Edu (localhost [127.0.0.1]) > by Ag.Arizona.Edu (8.9.3+Sun/8.9.3) with ESMTP id IAA10642; Tue, > 01 Aug 2000 08:28:23 -0700 (MST) >Date: Tue, 01 Aug 2000 08:28:23 -0700 (MST) >From: arid_gardener-request(a)Ag.Arizona.Edu >Subject: Arid_gardener digest, Vol 1 #1044 - 14 msgs >Sender: arid_gardener-admin(a)Ag.Arizona.Edu >To: arid_gardener(a)Ag.Arizona.Edu >Errors-to: arid_gardener-admin(a)Ag.Arizona.Edu >Reply-to: arid_gardener(a)Ag.Arizona.Edu >Message-id: <200008011528.IAA10642(a)Ag.Arizona.Edu> >MIME-version: 1.0 >X-Mailer: Mailman v2.0beta4 >Content-type: text/plain >Content-transfer-encoding: 8BIT >Precedence: bulk >X-BeenThere: arid_gardener(a)Ag.Arizona.Edu >X-Mailman-Version: 2.0beta4 >List-Id: Gardening and Landscaping in Dry Climates > <arid_gardener.Ag.Arizona.Edu> >X-UIDL: dd1d8704dcdf885578d8bfa0dfbb7020 > >arid_gardenerSend Arid_gardener mailing list submissions to > arid_gardener(a)Ag.Arizona.Edu > >To subscribe or unsubscribe via the World Wide Web, visit > http://Ag.Arizona.Edu/mailman/listinfo/arid_gardener >or, via email, send a message with subject or body 'help' to > arid_gardener-request(a)Ag.Arizona.Edu > >You can reach the person managing the list at > arid_gardener-admin(a)Ag.Arizona.Edu > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Arid_gardener digest..." > > >arid_gardener digest > >Today's Topics: > > 1. Re: re pantry pests (Sue Bass) > 2. Salt in Soil - Brown Leaves - Soil Amendments for Arizona - Rain > Water (Ursula Miller) > 3. Question from Home-Hort WWW page (fscapellit(a)mindspring.com) > 4. Question from Home-Hort WWW page (bonnford(a)amug.org) > 5. Question from Home-Hort WWW page (archsoul(a)home.com) > 6. Fwd: (Marikelly Block) > 7. YUCCA (Sue Hakala) > 8. RE: Question from Home-Hort WWW page (Ursula Miller) > 9. Question from Home-Hort WWW page (kffrmw88(a)mindspring.com) > 10. Re: Flood of maillist posts (Sue Bass) > 11. Problems! (Sue Bass) > 12. Re: repeat, repeat, repeat (Sue Bass) > 13. Fw: [AG] Grape Vines Available (Olin Miller) > 14. Question from Home-Hort WWW page (icbcd(a)mainex1.asu.edu) > >--__--__-- > >Message: 1 >Date: Mon, 31 Jul 2000 19:52:40 -0700 >From: Sue Bass <sjbass(a)uswest.net> >To: Mapgoddess(a)aol.com [SNIP!!!] [View Less]

1 0

Can I hide "restricted" lists on the main mailman html page?
by Brian J. Murrell Aug. 1, 2000

Aug. 1, 2000

I have some lists that I would like to run on my mailman server which need to be "hidden" from general users. Meaning that when an "unknown somebody" goes to the http://.../mailman/listinfo/ page, I would like some of the lists not listed there. Having the list named on the page but requiring a password to follow the link is not workable because just the name of the list is too much of a leak of information. I envision a http://.../mailman/listinfo/ page that shows all of the "public" lists. … [View More]

2 2

Re: [Mailman-Users] A Vote Against Passwords
by J C Lawrence Aug. 1, 2000

Aug. 1, 2000

On Tue, 1 Aug 2000 23:12:04 +1000 Chuck Dale <bug(a)aphid.net> wrote: > I vote to have the password facilities in Mailman toned down. I > would like them removed but at least to make this optional. Configurable is Okay -- but they're too damned useful to remove. > And definitely to make the "Send Password Reminders Every > Month" option default to OFF. Choice. I prefer them on for the reasoning below. > I say this after another month of receiving more than 10 … [View More]

1 0

Bug after update to 2.0beta4
by Ralf Hildebrandt Aug. 1, 2000

Aug. 1, 2000

Prior to the update to 2.0beta4 (have been running 2.0beta2 or 1) everything has been running smoothly (except for the pending administrative requests -- thus I upgraded). I used identical options when configure'ing Beta 4 After the update, nothing (!) happens when I send mail to any of my three lists. From my maillog: Aug 1 12:43:50 stahlw06 postfix/local[10065]: 900E014554: to=<litquiz(a)stahlw06.stahl.bau.tu-bs.de>, relay=local, delay=72, status=sent ("|/users2/mailman/mail/… [View More]

1 0

List of subscriptions
by David Champion Aug. 1, 2000

Aug. 1, 2000

I've had users ask if there's any way to see a list of their subscriptions on my server. I know about the "Your other foo.mil subscriptions", but is there any access to that information (.../handle_opts/list/user) that does not require the user to know at least one list they're on? -- -D. dgc(a)uchicago.edu NSIT University of Chicago

1 0