Vulnerability in Lyris Listserver

[blue0ne () IGLOO ORG (Jimmy Lee Alderson)]

The following is associated with a  post to NTbugtraq.  The original post
vaguely describes a security problem inherent in a popular server.  I
recently found this problem on my own, and was going to post. But since it
has already been posted I have decided to post it to bugtraq, with some
value added.  I have included the original afer my signature.


The web interface for the Lyris listserver is a perl based script located
in the /cgi-bin/ directory on a web server by default.  This server
contains a vulnerability that allows access at any of the three levels of
admin that Lyris allows.


List Admin: Manages a particular list on a server.

Site Admin: Manages a the entire group of lists.

Server Admin: Manages the entire server.

Server admin is the most interesting because it allows you to specify a
command that should be executed either prior to or after processing mail
sent to the listserver.  This allows a remote attacker to execute
arbitrary commands on the remote system as the user the list server is
running as.


(See the original post below for the fix information)



Jimmy Alderson





 -------original post below-------------


 Hello all: I've been trading email with list-manager Russ, and he
 suggested I post a message to this list.

 A few weeks ago, we (the makers of the Lyris List Server) were informed
 by one of our users of a potential security vulnerability in the web
 interface of our program. While we haven't had any reports of the
 vulnerability being exploited at any of our customer's sites, we did
 replicate the problem and confirm that the vulnerability existed.

 At the time, we made a patch fix available which could be applied to the
 current (2.54) and beta (2.548) release versions.  Then, we released a
 v3.0 beta version of Lyris, which had the bug fix.

 A few days ago, we released Lyris v3.0 out of beta, as a release version.
 This v3.0 release has the fix for the security vulnerability, as well as
 other things as part of the new version.

 We're recommending that any site running any version of Lyris upgrade to
 this v3.0 release. There is no charge to upgrade, and the upgrade program
 will preserve all current settings.

 Lyris v3.0 can be downloaded from here: http://www.lyris.com/down/

 If you don't know what Lyris List Server is, you may be interested in
 this 3rd party review on Forrest Stroud's "ServerWatch" web site:
 http://serverwatch.internet.com/listreview-lyris.html

 Obviously, we've announced these security concerns, and the fixes, to all
 our existing user base.  In my email exchange with Russ, he felt that the
 NTBugTraq list would benefit from knowing about this update, and that's
 the reason I'm posting this message.

 John