Vulnerability Name:

CVE-2006-0052 (CCN-29314)

Assigned:2005-06-06
Published:2005-06-06
Updated:2018-10-03
Summary:The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary.
CVSS v3 Severity:7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
5.8 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Denial of Service
References:Source: SGI
Type: UNKNOWN
20060602-01-U

Source: CONFIRM
Type: Patch
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358892

Source: MITRE
Type: CNA
CVE-2006-0052

Source: CCN
Type: RHSA-2006-0486
mailman security update

Source: SECUNIA
Type: UNKNOWN
19522

Source: SECUNIA
Type: UNKNOWN
19545

Source: SECUNIA
Type: UNKNOWN
19571

Source: SECUNIA
Type: UNKNOWN
20624

Source: SECUNIA
Type: UNKNOWN
20782

Source: CCN
Type: SECTRACK ID: 1015851
GNU Mailman MIME Multipart Parsing Error in `scrubber.py` May Let Remote Users Deny Service

Source: SECTRACK
Type: UNKNOWN
1015851

Source: CCN
Type: ASA-2006-125
mailman security update (RHSA-2006-0486)

Source: DEBIAN
Type: UNKNOWN
DSA-1027

Source: DEBIAN
Type: DSA-1027
mailman -- programming error

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:061

Source: SUSE
Type: UNKNOWN
SUSE-SR:2006:008

Source: OSVDB
Type: UNKNOWN
24367

Source: CCN
Type: OSVDB ID: 24367
Mailman Scrubber.py Crafted Multipart MIME Message DoS

Source: REDHAT
Type: UNKNOWN
RHSA-2006:0486

Source: BID
Type: Patch
17311

Source: CCN
Type: BID-17311
GNU Mailman Attachment Scrubber Malformed MIME Message Denial Of Service Vulnerability

Source: CCN
Type: USN-267-1
mailman vulnerability

Source: XF
Type: UNKNOWN
mailman-scrubber-dos(29314)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:9475

Source: UBUNTU
Type: UNKNOWN
USN-267-1

Source: SUSE
Type: SUSE-SR:2006:008
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:gnu:mailman:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:1.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0:beta3:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0:beta4:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0:beta5:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.13:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.14:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1b1:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:gnu:mailman:2.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:1.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.13:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.14:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0:beta3:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0:beta4:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.0:beta5:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1.1:beta1:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1.4:*:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20060052
    V
    		CVE-2006-0052
    2015-11-16
    oval:org.mitre.oval:def:9475
    V
    		The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary.
    2013-04-29
    oval:com.redhat.rhsa:def:20060486
    P
    		RHSA-2006:0486: mailman security update (Moderate)
    2006-06-09
    oval:org.debian:def:1027
    V
    		programming error
    2006-04-06
    BACK
    gnu mailman 1.0
    gnu mailman 1.1
    gnu mailman 2.0
    gnu mailman 2.0 beta3
    gnu mailman 2.0 beta4
    gnu mailman 2.0 beta5
    gnu mailman 2.0.1
    gnu mailman 2.0.2
    gnu mailman 2.0.3
    gnu mailman 2.0.4
    gnu mailman 2.0.5
    gnu mailman 2.0.6
    gnu mailman 2.0.7
    gnu mailman 2.0.8
    gnu mailman 2.0.9
    gnu mailman 2.0.10
    gnu mailman 2.0.11
    gnu mailman 2.0.12
    gnu mailman 2.0.13
    gnu mailman 2.0.14
    gnu mailman 2.1
    gnu mailman 2.1.1
    gnu mailman 2.1.2
    gnu mailman 2.1.3
    gnu mailman 2.1.4
    gnu mailman 2.1.5
    gnu mailman 2.1b1
    gnu mailman 2.1
    gnu mailman 2.1.5
    gnu mailman 1.0
    gnu mailman 1.1
    gnu mailman 2.0
    gnu mailman 2.0.1
    gnu mailman 2.0.10
    gnu mailman 2.0.11
    gnu mailman 2.0.12
    gnu mailman 2.0.13
    gnu mailman 2.0.14
    gnu mailman 2.0.2
    gnu mailman 2.0.3
    gnu mailman 2.0.4
    gnu mailman 2.0.5
    gnu mailman 2.0.6
    gnu mailman 2.0.7
    gnu mailman 2.0.8
    gnu mailman 2.0.9
    gnu mailman 2.0 beta3
    gnu mailman 2.0 beta4
    gnu mailman 2.0 beta5
    gnu mailman 2.1.1
    gnu mailman 2.1.1 beta1
    gnu mailman 2.1.2
    gnu mailman 2.1.3
    gnu mailman 2.1.4
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    debian debian linux 3.1
    suse linux enterprise server 9
    mandrakesoft mandrake linux corporate server 3.0