製品・ソフトウェアに関する情報

JVN脆弱性詳細

GNU Mailman の Cgi/confirm.py におけるクロスサイトスクリプティングの脆弱性

タイトル	GNU Mailman の Cgi/confirm.py におけるクロスサイトスクリプティングの脆弱性
概要	GNU Mailman の Cgi/confirm.py には、クロスサイトスクリプティングの脆弱性が存在します。
想定される影響	第三者により、確認メッセージのフルネームまたはユーザネームフィールドを介して、任意の Web スクリプトまたは HTML を挿入される可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2011年2月22日0:00
登録日	2011年3月28日16:16
最終更新日	2011年6月3日8:58

CVSS2.0 : 警告
スコア	4.3
ベクター	AV:N/AC:M/Au:N/C:N/I:P/A:N

影響を受けるシステム

レッドハット

Red Hat Enterprise Linux 4 (as)

Red Hat Enterprise Linux 4 (es)

Red Hat Enterprise Linux 4 (ws)

Red Hat Enterprise Linux 4.8 (as)

Red Hat Enterprise Linux 4.8 (es)

Red Hat Enterprise Linux 5 (server)

Red Hat Enterprise Linux Desktop 4.0

Red Hat Enterprise Linux Server 6

Red Hat Enterprise Linux Workstation 6

RHEL Desktop Workstation 5 (client)

ターボリナックス

Turbolinux Appliance Server 3.0

Turbolinux Appliance Server 3.0 (x64)

Turbolinux Server 11

Turbolinux Server 11 (x64)

サイバートラスト株式会社

Asianux Server 3 (x86)

Asianux Server 3 (x86-64)

Asianux Server 3.0

Asianux Server 3.0 (x86-64)

Asianux Server 4.0

Asianux Server 4.0 (x86-64)

GNU Project

GNU Mailman 2.1.14 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0707	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0707
National Vulnerability Database (NVD)
2	CVE-2011-0707	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0707

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	名前	URL
Asianux Technical Support Network
1	mailman-2.1.11-3.4.AXS3	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=1358
Mailman-Announce
2	000157	http://mail.python.org/pipermail/mailman-announce/2011-February/000157.html
MIRACLE LINUX アップデート情報
3	2194	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=2194
Red Hat Security Advisory
4	RHSA-2011:0307	https://rhn.redhat.com/errata/RHSA-2011-0307.html
5	RHSA-2011:0308	https://rhn.redhat.com/errata/RHSA-2011-0308.html
Turbolinux Security Advisory
6	TLSA-2011-14	http://www.turbolinux.co.jp/security/2011/TLSA-2011-14j.txt

その他

No	名前	URL
ISS X-Force Database
1	65538	http://xforce.iss.net/xforce/xfdb/65538
OPEN SOURCE VULNERABILITY DATABASE (OSVDB)
2	70936	http://osvdb.org/70936
Secunia Advisory
3	SA43389	http://secunia.com/advisories/43389
4	SA43549	http://secunia.com/advisories/43549
5	SA43580	http://secunia.com/advisories/43580
SecurityFocus
6	46464	http://www.securityfocus.com/bid/46464
SecurityTracker
7	1025106	http://www.securitytracker.com/id?1025106
VUPEN Security
8	VUPEN/ADV-2011-0435	http://www.vupen.com/english/advisories/2011/0435
9	VUPEN/ADV-2011-0542	http://www.vupen.com/english/advisories/2011/0542

変更履歴

No	変更内容	変更日
0	[2011年03月28日] 掲載 [2011年04月05日] 影響を受けるシステム：ミラクル・リナックス (mailman-2.1.11-3.4.AXS3) の情報を追加ベンダ情報：ミラクル・リナックス (mailman-2.1.11-3.4.AXS3) を追加 [2011年06月03日] 影響を受けるシステム：ターボリナックス (TLSA-2011-14) の情報を追加ベンダ情報：ターボリナックス (TLSA-2011-14) を追加	2018年2月17日10:37

NVD脆弱性情報

CVE-2011-0707

概要	Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.
公表日	2011年2月23日4:00
登録日	2021年1月28日16:37
最終更新日	2024年11月21日10:24

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:gnu:mailman:2.1.13:::::::*
cpe:2.3:a:gnu:mailman:2.1.5:::::::*
cpe:2.3:a:gnu:mailman:2.1.11:rc1::::::
cpe:2.3:a:gnu:mailman:2.0.5:::::::*
cpe:2.3:a:gnu:mailman:2.0.1:::::::*
cpe:2.3:a:gnu:mailman:2.1.5.8:::::::*
cpe:2.3:a:gnu:mailman:2.1.3:::::::*
cpe:2.3:a:gnu:mailman:2.0.11:::::::*
cpe:2.3:a:gnu:mailman:2.0.6:::::::*
cpe:2.3:a:gnu:mailman:2.0:beta3::::::
cpe:2.3:a:gnu:mailman:2.1.8:::::::*
cpe:2.3:a:gnu:mailman:2.1.11:rc2::::::
cpe:2.3:a:gnu:mailman:1.1:::::::*
cpe:2.3:a:gnu:mailman:2.0.14:::::::*
cpe:2.3:a:gnu:mailman:2.0:beta5::::::
cpe:2.3:a:gnu:mailman:2.0.12:::::::*
cpe:2.3:a:gnu:mailman:2.1.13:rc1::::::
cpe:2.3:a:gnu:mailman:2.0:::::::*
cpe:2.3:a:gnu:mailman:2.1.11:::::::*
cpe:2.3:a:gnu:mailman:2.0:beta4::::::
cpe:2.3:a:gnu:mailman:2.1.2:::::::*
cpe:2.3:a:gnu:mailman:2.0.9:::::::*
cpe:2.3:a:gnu:mailman:2.1.9:::::::*
cpe:2.3:a:gnu:mailman:2.0.3:::::::*
cpe:2.3:a:gnu:mailman:2.1:stable::::::
cpe:2.3:a:gnu:mailman:2.1.14:rc1::::::
cpe:2.3:a:gnu:mailman:2.0.13:::::::*
cpe:2.3:a:gnu:mailman:2.1.6:::::::*
cpe:2.3:a:gnu:mailman:2.1:alpha::::::
cpe:2.3:a:gnu:mailman:2.0.4:::::::*
cpe:2.3:a:gnu:mailman:2.1:::::::*
cpe:2.3:a:gnu:mailman:2.1:beta::::::
cpe:2.3:a:gnu:mailman:2.1b1:::::::*
cpe:2.3:a:gnu:mailman::::::::		2.1.14
cpe:2.3:a:gnu:mailman:2.1.10:::::::*
cpe:2.3:a:gnu:mailman:2.1.1:::::::*
cpe:2.3:a:gnu:mailman:2.1.12:::::::*
cpe:2.3:a:gnu:mailman:1.0:::::::*
cpe:2.3:a:gnu:mailman:2.0.8:::::::*
cpe:2.3:a:gnu:mailman:2.1.7:::::::*
cpe:2.3:a:gnu:mailman:2.1.4:::::::*
cpe:2.3:a:gnu:mailman:2.0.10:::::::*
cpe:2.3:a:gnu:mailman:2.1.1:beta1::::::
cpe:2.3:a:gnu:mailman:2.0.2:::::::*
cpe:2.3:a:gnu:mailman:2.0.7:::::::*

関連情報、対策とツール

No	URL	タグ
1	http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
2	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056363.html
3	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056387.html
4	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056399.html
5	http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
6	http://lists.opensuse.org/opensuse-updates/2011-05/msg00000.html
7	http://mail.python.org/pipermail/mailman-announce/2011-February/000157.html
8	http://mail.python.org/pipermail/mailman-announce/2011-February/000158.html	Patch
9	http://osvdb.org/70936
10	http://secunia.com/advisories/43294	Vendor Advisory
11	http://secunia.com/advisories/43389	Vendor Advisory
12	http://secunia.com/advisories/43425	Vendor Advisory
13	http://secunia.com/advisories/43549
14	http://secunia.com/advisories/43580
15	http://secunia.com/advisories/43829
16	http://support.apple.com/kb/HT5002
17	http://www.debian.org/security/2011/dsa-2170
18	http://www.mandriva.com/security/advisories?name=MDVSA-2011:036
19	http://www.redhat.com/support/errata/RHSA-2011-0307.html
20	http://www.redhat.com/support/errata/RHSA-2011-0308.html
21	http://www.securityfocus.com/bid/46464
22	http://www.securitytracker.com/id?1025106
23	http://www.ubuntu.com/usn/USN-1069-1
24	http://www.vupen.com/english/advisories/2011/0435	Vendor Advisory
25	http://www.vupen.com/english/advisories/2011/0436	Vendor Advisory
26	http://www.vupen.com/english/advisories/2011/0460	Vendor Advisory
27	http://www.vupen.com/english/advisories/2011/0487
28	http://www.vupen.com/english/advisories/2011/0542
29	http://www.vupen.com/english/advisories/2011/0720
30	https://exchange.xforce.ibmcloud.com/vulnerabilities/65538
31	http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
32	https://exchange.xforce.ibmcloud.com/vulnerabilities/65538
33	http://www.vupen.com/english/advisories/2011/0720
34	http://www.vupen.com/english/advisories/2011/0542
35	http://www.vupen.com/english/advisories/2011/0487
36	http://www.vupen.com/english/advisories/2011/0460	Vendor Advisory
37	http://www.vupen.com/english/advisories/2011/0436	Vendor Advisory
38	http://www.vupen.com/english/advisories/2011/0435	Vendor Advisory
39	http://www.ubuntu.com/usn/USN-1069-1
40	http://www.securitytracker.com/id?1025106
41	http://www.securityfocus.com/bid/46464
42	http://www.redhat.com/support/errata/RHSA-2011-0308.html
43	http://www.redhat.com/support/errata/RHSA-2011-0307.html
44	http://www.mandriva.com/security/advisories?name=MDVSA-2011:036
45	http://www.debian.org/security/2011/dsa-2170
46	http://support.apple.com/kb/HT5002
47	http://secunia.com/advisories/43829
48	http://secunia.com/advisories/43580
49	http://secunia.com/advisories/43549
50	http://secunia.com/advisories/43425	Vendor Advisory
51	http://secunia.com/advisories/43389	Vendor Advisory
52	http://secunia.com/advisories/43294	Vendor Advisory
53	http://osvdb.org/70936
54	http://mail.python.org/pipermail/mailman-announce/2011-February/000158.html	Patch
55	http://mail.python.org/pipermail/mailman-announce/2011-February/000157.html
56	http://lists.opensuse.org/opensuse-updates/2011-05/msg00000.html
57	http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
58	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056399.html
59	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056387.html
60	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056363.html

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

構成1	以上	以下	より上	未満
cpe:2.3:a:gnu:mailman:2.1.13:::::::*
cpe:2.3:a:gnu:mailman:2.1.5:::::::*
cpe:2.3:a:gnu:mailman:2.1.11:rc1::::::
cpe:2.3:a:gnu:mailman:2.0.5:::::::*
cpe:2.3:a:gnu:mailman:2.0.1:::::::*
cpe:2.3:a:gnu:mailman:2.1.5.8:::::::*
cpe:2.3:a:gnu:mailman:2.1.3:::::::*
cpe:2.3:a:gnu:mailman:2.0.11:::::::*
cpe:2.3:a:gnu:mailman:2.0.6:::::::*
cpe:2.3:a:gnu:mailman:2.0:beta3::::::
cpe:2.3:a:gnu:mailman:2.1.8:::::::*
cpe:2.3:a:gnu:mailman:2.1.11:rc2::::::
cpe:2.3:a:gnu:mailman:1.1:::::::*
cpe:2.3:a:gnu:mailman:2.0.14:::::::*
cpe:2.3:a:gnu:mailman:2.0:beta5::::::
cpe:2.3:a:gnu:mailman:2.0.12:::::::*
cpe:2.3:a:gnu:mailman:2.1.13:rc1::::::
cpe:2.3:a:gnu:mailman:2.0:::::::*
cpe:2.3:a:gnu:mailman:2.1.11:::::::*
cpe:2.3:a:gnu:mailman:2.0:beta4::::::
cpe:2.3:a:gnu:mailman:2.1.2:::::::*
cpe:2.3:a:gnu:mailman:2.0.9:::::::*
cpe:2.3:a:gnu:mailman:2.1.9:::::::*
cpe:2.3:a:gnu:mailman:2.0.3:::::::*
cpe:2.3:a:gnu:mailman:2.1:stable::::::
cpe:2.3:a:gnu:mailman:2.1.14:rc1::::::
cpe:2.3:a:gnu:mailman:2.0.13:::::::*
cpe:2.3:a:gnu:mailman:2.1.6:::::::*
cpe:2.3:a:gnu:mailman:2.1:alpha::::::
cpe:2.3:a:gnu:mailman:2.0.4:::::::*
cpe:2.3:a:gnu:mailman:2.1:::::::*
cpe:2.3:a:gnu:mailman:2.1:beta::::::
cpe:2.3:a:gnu:mailman:2.1b1:::::::*
cpe:2.3:a:gnu:mailman::::::::		2.1.14
cpe:2.3:a:gnu:mailman:2.1.10:::::::*
cpe:2.3:a:gnu:mailman:2.1.1:::::::*
cpe:2.3:a:gnu:mailman:2.1.12:::::::*
cpe:2.3:a:gnu:mailman:1.0:::::::*
cpe:2.3:a:gnu:mailman:2.0.8:::::::*
cpe:2.3:a:gnu:mailman:2.1.7:::::::*
cpe:2.3:a:gnu:mailman:2.1.4:::::::*
cpe:2.3:a:gnu:mailman:2.0.10:::::::*
cpe:2.3:a:gnu:mailman:2.1.1:beta1::::::
cpe:2.3:a:gnu:mailman:2.0.2:::::::*
cpe:2.3:a:gnu:mailman:2.0.7:::::::*