full-disclosure - Re: [FD] Security flaw in Full Disclosure mailing list

Open Source and information security mailing list archives

Message-ID: <CAGfsgR1yvMhn=h2YFZO_gTtjpQFydQM8_mC0mqZs4ZF7GB1J1Q@mail.gmail.com>
Date: Wed, 2 Apr 2014 16:06:24 -0400
From: Jim Popovitch <jimpop@...il.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] Security flaw in Full Disclosure mailing list

Mailman always needs some post-install tweaks.....

Just apply this (for mm 2.1.x)

--- cron/mailpasswds 2012-11-02 03:19:11 +0000
+++ cron/mailpasswds 2013-03-03 21:26:43 +0000
@@ -184,7 +184,7 @@
                     fmt = '%s\n           %-10s\n%s\n'
                 else:
                     fmt = '%-40s %-10s\n%s\n'
-                table.append(fmt % (listaddr, password, optionsurl))
+                table.append(fmt % (listaddr, "********", optionsurl))
             # Figure out which language to use
             langcnt = 0
             poplang = None


-Jim P.

On Wed, Apr 2, 2014 at 3:20 PM, Fyodor <fyodor@...p.org> wrote:
> On Wed, Apr 2, 2014 at 11:54 AM, Jimmy Crossley <jcrossley@...etrix.com>wrote:
>
>> This "feature" can be disabled in the options after logging in at
>> http://nmap.org/mailman/options/fulldisclosure.
>>
>> Select No to the "Get password reminder email for this list?" item.
>>
>
> You don't need to worry about that on this list (or any other list I run)
> since the monthly password "reminder" feature is fully disabled.  But these
> are great instructions for people to use on any lists which do send the
> annoying reminders.  Mailman on this list does still send the "password" it
> generates at list subscription time and if you request a password reminder.
>  This is just used for people to edit their individual list preferences.
>
> Cheers,
> Fyodor
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/


lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives