Test ID:	1.3.6.1.4.1.25623.1.0.52577
Category:	Fedora Local Security Checks
Title:	Fedora Core 2 FEDORA-2005-241 (mailman)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to mailman announced via advisory FEDORA-2005-241. A cross-site scripting (XSS) flaw in the driver script of mailman prior to version 2.1.5 could allow remote attackers to execute scripts as other web users. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1177 to this issue. Users of mailman should update to this erratum package, which corrects this issue by turning on STEALTH_MODE by default and using Utils.websafe() to quote the html. This update can be downloaded from: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/ This update can also be installed with the Update Agent you can launch the Update Agent with the 'up2date' command. Solution: Apply the appropriate updates. http://www.fedoranews.org/blog/index.php?p=511 Risk factor : Medium CVSS Score: 5.0
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2004-1177 Bugtraq: 20050110 [USN-59-1] mailman vulnerabilities (Google Search) http://marc.info/?l=bugtraq&m=110549296126351&w=2 Debian Security Information: DSA-674 (Google Search) http://www.debian.org/security/2005/dsa-674 http://www.mandriva.com/security/advisories?name=MDKSA-2005:015 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11113 http://www.redhat.com/support/errata/RHSA-2005-235.html http://secunia.com/advisories/13603 SuSE Security Announcement: SUSE-SA:2005:007 (Google Search) http://www.novell.com/linux/security/advisories/2005_07_mailman.html XForce ISS Database: mailman-script-driver-xss(18854) https://exchange.xforce.ibmcloud.com/vulnerabilities/18854 Common Vulnerability Exposure (CVE) ID: CVE-2005-0202 http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html Bugtraq: 20050209 [USN-78-1] Mailman vulnerability (Google Search) http://marc.info/?l=bugtraq&m=110805795122386&w=2 http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031562.html http://www.gentoo.org/security/en/glsa/glsa-200502-11.xml http://www.mandriva.com/security/advisories?name=MDKSA-2005:037 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10657 http://www.redhat.com/support/errata/RHSA-2005-136.html http://www.redhat.com/support/errata/RHSA-2005-137.html http://securitytracker.com/id?1013145 http://secunia.com/advisories/14211
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.