Update of /cvsroot/mailman/mailman/Mailman
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv8958
Modified Files:
Tag: Release_2_0_1-branch
MailCommandHandler.py
Log Message:
ParseMailCommand(): Check for the subject line split returning the empty
list before trying to use it. This fixes CAN-2003-0991 denial of service
attack. Committing to CVS although it's unclear whether there will be a
Mailman 2.0.14.
Index: MailCommandHandler.py
===================================================================
RCS file: /cvsroot/mailman/mailman/Mailman/Attic/MailCommandHandler.py,v
retrieving revision 1.70.2.2
retrieving revision 1.70.2.3
diff -u -d -r1.70.2.2 -r1.70.2.3
--- MailCommandHandler.py 11 Jul 2002 21:19:34 -0000 1.70.2.2
+++ MailCommandHandler.py 6 Feb 2004 18:33:38 -0000 1.70.2.3
@@ -1,4 +1,4 @@
-# Copyright (C) 1998,1999,2000,2001,2002 by the Free Software Foundation, Inc.
+# Copyright (C) 1998-2004 by the Free Software Foundation, Inc.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
@@ -160,8 +160,9 @@
mo = quotecre.search(subject)
if mo:
subject = mo.group('cmd')
- if (subject and
- self.__dispatch.has_key(string.lower(string.split(subject)[0]))):
+ splitsubj = string.split(subject)
+ if (subject and splitsubj and
+ self.__dispatch.has_key(string.lower(splitsubj[0]))):
lines = [subject] + string.split(msg.body, '\n')
else:
lines = string.split(msg.body, '\n')
_______________________________________________
Mailman-checkins mailing list
[EMAIL PROTECTED]
Unsubscribe: http://mail.python.org/mailman/options/mailman-checkins/archive%40jab.org
