Mailing list application Majordomo 2 reveals file content

[J65nko]

From http://www.h-online.com/security/new...t-1183034.html

A bug in the way path names are evaluated means that it is possible to view the content of arbitrary files on a Majordomo mailing list system using the help command. The vulnerability can be exploited via both the web and email interfaces in Mojordomo2. According to a security advisory, simply sending an email with the content help ../../../../../../../../../../../../../etc/passwd to the Majordomo account is sufficient to receive a response containing the content of the /etc/password file. The bug is fixed in snapshot versions majordomo-20110125 (direct download) and later.)

[jggimi]

Clarification: This is for Majordomo 2, an "upwardly compatible rewrite" of the original Majordomo ... and does not apply to the original Majordomo.

The original is what is in the OpenBSD ports tree (mail/majordomo). It had a patch just yesterday, but entirely unrelated. The patch was for a regression caused by Perl 5.12.

I just tested this vulnerability with the original Majordomo, in a 17 day old -current. No response from the example exploit string via Email.