Debian Bug report logs - #339095
Dos attack to a list in mailman using sarge due to impropper handling of exception of utf8

Full log

Message #35 received at 339095@bugs.debian.org (full text, mbox, reply):

Received: (at 339095) by bugs.debian.org; 14 Nov 2005 22:45:07 +0000
From master@capsaicin.mamane.lu Mon Nov 14 14:45:07 2005
Return-path: <master@capsaicin.mamane.lu>
Received: from 213-84-114-29.adsl.xs4all.nl ([213.84.114.29] helo=capsaicin.mamane.lu)
	by spohr.debian.org with esmtp (Exim 4.50)
	id 1Ebn4U-0007Oc-TE
	for 339095@bugs.debian.org; Mon, 14 Nov 2005 14:45:07 -0800
Received: from master by capsaicin.mamane.lu with local (Exim 4.54)
	id 1Ebn4L-0006bm-BA; Mon, 14 Nov 2005 23:44:57 +0100
Date: Mon, 14 Nov 2005 23:44:57 +0100
From: Lionel Elie Mamane <lionel@mamane.lu>
To: 339095@bugs.debian.org, aliet@tesla.cujae.edu.cu
Cc: joostvb-debian-bugs-20051024-9@mdcc.cx
Subject: Can't reproduce this bug as described
Message-ID: <20051114224457.GC22283@capsaicin.mamane.lu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
X-Operating-System: GNU/Linux
X-Request-PGP: http://www.mamane.lu/openpgp/rsa_v4_4096.asc
User-Agent: Mutt/1.5.11
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 
	(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level: 
X-Spam-Status: No, hits=-3.0 required=4.0 tests=BAYES_00 autolearn=no 
	version=2.60-bugs.debian.org_2005_01_02

Hi,

I'm writing to you about the bug you reported to Debian about
Mailman. (http://bugs.debian.org/339095)

I can't reproduce the bug as you describe it, at least the DOS
part. In my testing, messages with attachments with an invalid
filename:

 - _do_ get distributed
 - do _not_ get archived
 - generate a traceback much like yours
 - do _not_ DOS the list: subsequent (valid) messages get delivered
   and archived correctly.

The "do not get archived" part is still a bug, one that will
(hopefully) be fixed with the next Debian upload. But if they don't
DOS the list, it is not a security issue and doesn't warrant a
security update to Debian stable.

I used exactly the filename you put in your bug report for my
testing.


If you have a message that DOSes a list, would be so kind as to send
it to mm-test@tofu.mamane.lu and notify us at
pkg-mailman-hackers@lists.alioth.debian.org ? I fear that the DOSing
comes from a different issue than the filename encoding, and in that
case I'd like to investigate it.


Thank you in advance,

-- 
Lionel Mamane, for the Debian Mailman team

Send a report that this bug log contains spam.