full-disclosure - Re: [FD] Security flaw in Full Disclosure mailing list

Open Source and information security mailing list archives

Message-ID: <20140402202514.GH5573@rincewind.skullsecurity.org>
Date: Wed, 2 Apr 2014 13:25:14 -0700
From: Ron <ron@...llsecurity.net>
To: Jim Popovitch <jimpop@...il.com>
Cc: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] Security flaw in Full Disclosure mailing list

That doesn't change the fact that it's storing the passwords in
plaintext, though, it just hides the 'your passwords are completely
insecure' issue a little bit.

Ron

On 2014-04-02 16:06, Jim Popovitch wrote:
> Mailman always needs some post-install tweaks.....
> 
> Just apply this (for mm 2.1.x)
> 
> --- cron/mailpasswds 2012-11-02 03:19:11 +0000
> +++ cron/mailpasswds 2013-03-03 21:26:43 +0000
> @@ -184,7 +184,7 @@
>                      fmt = '%s\n           %-10s\n%s\n'
>                  else:
>                      fmt = '%-40s %-10s\n%s\n'
> -                table.append(fmt % (listaddr, password, optionsurl))
> +                table.append(fmt % (listaddr, "********", optionsurl))
>              # Figure out which language to use
>              langcnt = 0
>              poplang = None
> 
> 
> -Jim P.
> 
> On Wed, Apr 2, 2014 at 3:20 PM, Fyodor <fyodor@...p.org> wrote:
> > On Wed, Apr 2, 2014 at 11:54 AM, Jimmy Crossley <jcrossley@...etrix.com>wrote:
> >
> >> This "feature" can be disabled in the options after logging in at
> >> http://nmap.org/mailman/options/fulldisclosure.
> >>
> >> Select No to the "Get password reminder email for this list?" item.
> >>
> >
> > You don't need to worry about that on this list (or any other list I run)
> > since the monthly password "reminder" feature is fully disabled.  But these
> > are great instructions for people to use on any lists which do send the
> > annoying reminders.  Mailman on this list does still send the "password" it
> > generates at list subscription time and if you request a password reminder.
> >  This is just used for people to edit their individual list preferences.
> >
> > Cheers,
> > Fyodor
> >
> > _______________________________________________
> > Sent through the Full Disclosure mailing list
> > http://nmap.org/mailman/listinfo/fulldisclosure
> > Web Archives & RSS: http://seclists.org/fulldisclosure/
> 
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives