Security Information / 2012 / Security Information -- DSA-2477-1 sympa

Debian Security Advisory

DSA-2477-1 sympa -- authorization bypass

Date Reported:

20 May 2012

Affected Packages:

sympa

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2012-2352.

More information:

Several vulnerabilities have been discovered in Sympa, a mailing list manager, that allow to skip the scenario-based authorization mechanisms. This vulnerability allows to display the archives management page, and download and delete the list archives by unauthorized users.

For the stable distribution (squeeze), this problem has been fixed in version 6.0.1+dfsg-4+squeeze1.

For the testing distribution (wheezy), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in version 6.1.11~dfsg-2.

We recommend that you upgrade your sympa packages.