SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Server)  >   Majordomo Vendors:   Chapman, Brent et al
Majordomo Mailing List Default Configuration Discloses List E-mail Addresses to Remote Users
SecurityTracker Alert ID:  1006040
SecurityTracker URL:  http://securitytracker.com/id/1006040
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Feb 5 2003
Impact:   Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 2 (alpha) and prior versions
Description:   An information disclosure vulnerability was reported in Majordomo. A remote user may be able to extract subscriber e-mail addresses from the server.

It is reported that if the 'which_access' setting is set to 'open' (the default configuration), then a remote user can view e-mail addresses subscribed to lists on the server.

The report indicates that an administrator must take explicit steps to prevent remote users from executing the "who", "which", "index", and "get" commands against a list.

A remote user can send one of the following commands to the server to receive a listing of all matching e-mail addresses:

which @
which .

This will cause the Majordomo application to return any addresses containing the specified character ('@' or '.' in this example), according to the report.

Impact:   A remote user can view the e-mail addresses on a particular Majordomo mailing list.
Solution:   The vendor has released a fixed version (Majordomo 2) that has a default configuration setting of "closed". The fixed version is available via CVS. For information about obtaining the fixed version, see:

http://www.math.uh.edu/majordomo/

For Majordomo versions 1.94.5 and earlier, you can create an empty file named "$listname.private" in the $listdir (as described in the documentation). This will reportedly restrict the set of users that can retrieve the address information to users that are subscribed to the list. Also, you can change any open 'which_access' configuration settings to 'closed'.

An unofficial patch for Majordomo 1.94.5 is provided in the Source Message.

Vendor URL:  www.greatcircle.com/majordomo/ (Links to External Site)
Cause:   Configuration error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  Majordomo info leakage, all versions


------------------------------------------------------------------------------- 
Title                   : Majordomo info leakage (all versions) 
Date                    : 03/02/2003 
Article by              : Marco van Berkum (m.v.berkum@obit.nl) 
Bug finder              : Jakub Klausa (jacke@bofh.pl) 
Investigated by         : Jakub Klausa and Marco van Berkum 
------------------------------------------------------------------------------- 

Introduction:
--------------
Some while ago Jakub Klausa mailed me about a problem regarding the
Majordomo mailinglist program. At first we were not sure if it was a one
time problem or a common issue, so we checked several other servers
and installed Majordomo ourselves and found ALL Majordomo versions to
be vulnerable, also the latest Majordomo 2 (alpha).

The problem:
---------------
All email addresses can be extracted from mailinglists for which
'which_access' is set to "open" in the configuration file, which_access
is set to "open" by default !!

 Majordomo 1.94.5 documentation quote:

    "8.  By default, anyone (even non-subscribers) can use the commands
         "who", "which", "index", and "get" on a list.  If you create an
         empty file named "listname.private" in the $listdir directory, only
         members of the list can use those commands."

Typical case of RTFDOC of course, but still, why isn't the private
configuration file the default one (?!), now people actually have to read
the documentation to protect their lists against evil spammers. We all
know that admins do not always read the docs (uhuh).

So this bug can be exploited without being subscribed to any mailinglist
on that server when "which_access" is set to open. This bug can be exploited
by sending:

   which @

   or

   which .

To the Majordomo daemon. Majordomo will then match "@" (or ".") on all the
mailinglists that have 'which_access' set to "open". This then matches
all email addresses that are subscribed to that list.

There is a slight difference between the new Majordomo 2 (alpha) and the
current Majordomo 1.94.x branch.

Majordomo 1.94.x gives output such as this:

>>>> which @
The string '@' appears in the following
entries in lists served by majordomo@somedomain.com:

List                    Address
====                    =======
test-list               user@somedomain.com
test-list               anotheruser@anotherdomain.com
another-list            satan@evilmajordomodomain.net
another-list            bush@sopranos.org

etc...

Majordomo 2 also has the bug, not as much as the 1.94.x though:

>>>> which @
The pattern "/\@/i"
matched the following subscriptions.

Matches for the devils mailing list:
  satan@majordomo.org
-- Match limit of 1 for devils exceeded.

Matches for the britney mailing list:
  eminem@spears.net
-- Match limit of 1 for britney exceeded.

Impact:
-------
High. Not only privacy is the issue here, this bug could be used by evil
spammers to fill their databases. And the users did much of their work for 
them already, as the victims are usually well targeted (subject-specific 
mailinglists come to mind).

Solution:
---------
general: 
Read the documentation regarding $listname.private and set all which_access 
to "closed", or update to Majordomo 2 alpha, which still requires the same attention.

Majordomo 1.94.5 and earlier:
As mentioned by the documentation that comes with Majordomo 1.94.5, 
create an empty file named "$listname.private" in the $listdir. 
It will only reduce the group of people being able to pick up all the addresses
to the ones subscribed to the list. Check your current configurations for 
open which_access, close them. 

Majordomo 2:
The authors responded quickly and changed default configuration settings 
to be "closed". Get the latest CVS version, and check your current 
configurations for open which_access, which_access should be closed at 
any time.

Jakub made a patch for Majordomo 1.94.5.

[Patch]
This is a patch for Majordomo 1.94.5, which makes the Majordomo 
ignore the 'which' request if they don't contain e-mail address-like
string as a parameter (roughly).


--- majordomo.orig      Mon Feb  3 13:23:45 2003
+++ majordomo   Mon Feb  3 13:23:23 2003
@@ -624,6 +624,11 @@
 
 sub do_which {
     local($subscriber) = join(" ", @_) || &valid_addr($reply_to);
+    if ($subscriber !~ /^[0-9a-zA-Z\.\-\_]+\@[0-9a-zA-Z\.\-]+\.[a-zA-Z]{2,3}$/) {
+       
+       &log("which abuse -> $subscriber passed as an argument.");
+       exit(0);
+       };
     local($count, $per_list_hits) = 0;
     # Tell the requestor which lists they are on by reading through all
     # the lists, comparing their address to each address from each list


Cheers

Marco van Berkum / http://ws.obit.nl / m.v.berkum@obit.nl
Jakub Klausa / jacke@bofh.pl

-- 
find / -user your -name base -exec chown us:us {}\;
 ----------------------------------------
|    Marco van Berkum / MB17300-RIPE     |
| m.v.berkum@obit.nl / http://ws.obit.nl |
 ----------------------------------------

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC