CVE-2006-0052

Mailman 2.1.5 Attachment Scrubber DoS.

• CVSS 5.0
• CWE-400: Uncontrolled Resource Consumption
• Configuration Issues
• Remote

The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary.

CVE

CVE-2006-0052

CWE

CWE-400: Uncontrolled Resource Consumption

CVSS base score

5.0

Published

2006-03-31

OWASP

A03 Injection

Orthogonal defect classification

Algorithm

Code defect classification

Missing Algorithm

Category

Configuration Issues

Subcategory

Server-Side Request Forgery (SSRF)

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update to Mailman version 2.1.6 or higher

import email
from email.parser import Parser

def process_mime_message(raw_data):
    msg = Parser().parsestr(raw_data.decode('utf-8'))
    
    if msg.is_multipart():
        for part in msg.walk():
            print(part.get_payload(decode=True))

raw_email = b"""Content-Type: multipart/mixed; boundary="boundary"

--boundary

Content-Type: text/plain

This is a test message.


--boundary--"""

process_mime_message(raw_email)

import email
from email import policy
from email.parser import BytesParser

def process_mime_message(raw_data):
    msg = BytesParser(policy=policy.default).parsebytes(raw_data)
    
    if msg.is_multipart():
        for part in msg.iter_parts():
            if part.get_content_type() == 'text/plain':
                content = part.get_payload()
                if '\n\n' in content:
                    raise ValueError("Invalid MIME message: Contains two blank lines.")
    
    return True

try:
    raw_email = b"""Content-Type: multipart/mixed; boundary="boundary"
    
    --boundary
    Content-Type: text/plain
    
    This is a test message.
    
    --boundary--"""
    
    process_mime_message(raw_email)
    print("Valid MIME message.")
except ValueError as e:
    print(e)

@misc{vaitp:cve20060052,
  title        = {{Mailman 2.1.5 Attachment Scrubber DoS.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2006},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2006-0052},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2006-0052/}}
}