[-- BEGIN PGP SIGNED MESSAGE --]

       ----------------------------------------------------------------------------
       Debian Security Advisory                                 security@debian.org
       http://www.debian.org/security/                               Martin Schulze
       August 5, 2000
       ----------------------------------------------------------------------------

       Package: mailman
       Vulnerability: local mailman group exploit
       Debian-specific: no

       Former versions of mailman v2.0 came with a security problem,
       introduced during the 2.0 beta cycle, that could be exploited by
       clever local users to gain group mailman permission.  No exploit does
       exist at the moment, though.

       wget url
               will fetch the file for you
       dpkg -i file.deb
               will install the referenced file.


       Debian GNU/Linux 2.1 alias slink
       --------------------------------

         Slink comes with version 1.0 that is not vulnerable.

       Debian 2.2 alias potato
       -----------------------

         Potato comes with version 1.1 that is not vulnerable.

       Debian Unstable alias woody
       ---------------------------

         This version of Debian is not yet released and reflects the current
         development release.  Fixes are currently available for Intel ia32
         and Motorola 680x0.  Fixes for other architectures will be available
         soon.  In doubt, please recompile the package from source on your
         own.

         Source archives:

           ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5-1.diff.gz
             MD5 checksum: 177e666144c35d6b945b30dddf567fef                                   
           ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5-1.dsc
             MD5 checksum: 431d66e4ef496ce48463ed55193d375c                               
           ftp://ftp.debian.org/debian/dists/woody/main/source/mail/mailman_2.0beta5.orig.tar.gz
             MD5 checksum: 2c2602b7745a56adecd4f24fdd6d446f                                     

         Intel ia32 architecture:

           ftp://ftp.debian.org/debian/dists/woody/main/binary-i386/mail/mailman_2.0beta5-1.deb
             MD5 checksum: e2a071bf4a9a3be02978df47ed58acb6                                                                                

         Motorola 680x0 architecture:

           ftp://ftp.debian.org/debian/dists/woody/main/binary-m68k/mail/mailman_2.0beta5-1.deb
             MD5 checksum: 8bb6367c1e249beaaaa8eb3b7fc71c27                                    

       ----------------------------------------------------------------------------
       For apt-get: deb http://security.debian.org/ stable updates
       For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates
       Mailing list: debian-security-announce@lists.debian.org

       [-- END PGP SIGNED MESSAGE --]