703389 – several python scripts under /usr/lib/mailman/pythonlib are group writeable

Bug 703389 - several python scripts under /usr/lib/mailman/pythonlib are group writeable

Summary: several python scripts under /usr/lib/mailman/pythonlib are group writeable

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	mailman
Sub Component:
Version:	6.1
Hardware:	Unspecified
OS:	Unspecified
Priority:	low
Severity:	low
Target Milestone:	rc
Target Release:	---
Assignee:	Jan Kaluža
QA Contact:	qe-baseos-daemons
Docs Contact:
URL:
Whiteboard:
Depends On:	703388
Blocks:
TreeView+	depends on / blocked

Reported:	2011-05-10 08:42 UTC by Karel Srot
Modified:	2011-09-07 13:06 UTC (History)
CC List:	4 users (show)
Fixed In Version:	mailman-2.1.12-17.el6
Doc Type:	Bug Fix
Doc Text:	Previously, a number of Python scripts and subdirectories in the /usr/lib/mailman/ directory were group writable. As a result, the respective files and subdirectories could have been changed not only by the owner, but also by other users in the same user group. This undesired behavior has been resolved in this update so that only the owner can now change the files and subdirectories.
Clone Of:	703388
Environment:
Last Closed:	2011-09-07 13:06:17 UTC
Target Upstream Version:

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2011:1275	0	normal	SHIPPED_LIVE	mailman bug fix update	2011-09-07 13:05:53 UTC

Description Karel Srot 2011-05-10 08:42:54 UTC

Also in RHEL6, mailman-2.1.12-14.el6_0.2.x86_64

+++ This bug was initially created as a clone of Bug #703388 +++

Description of problem:

Several python scripts under /usr/lib/mailman are group writeable.
Files should not have more benevolent permissions that required. 

# find mailman/ -type f -perm  -g=w -exec ls -l {} \;
-rw-rw-r-- 1 root mailman 22 Feb 21 08:51 mailman/pythonlib/korean.pth
-rw-rw-r-- 1 root mailman 65 Mar  1  2002 mailman/pythonlib/japanese/ms932.py
-rw-rw-r-- 1 root mailman 784 Feb 21 08:51 mailman/pythonlib/japanese/aliases/__init__.pyc
-rw-rw-r-- 1 root mailman 948 Nov 29  2003 mailman/pythonlib/japanese/aliases/__init__.py
-rw-rw-r-- 1 root mailman 1002 Sep 26  2001 mailman/pythonlib/japanese/jis_x_0201_roman.py
-rw-rw-r-- 1 root mailman 158313 Sep 21  2002 mailman/pythonlib/japanese/mappings/jis_x_0208.py
-rw-rw-r-- 1 root mailman 158313 Sep 21  2002 mailman/pythonlib/japanese/mappings/shift_jis.py
-rw-rw-r-- 1 root mailman 165779 Feb 21 08:51 mailman/pythonlib/japanese/mappings/shift_jis.pyc
-rw-rw-r-- 1 root mailman 146090 Feb 21 08:51 mailman/pythonlib/japanese/mappings/jis_x_0212.pyc
-rw-rw-r-- 1 root mailman 136 Feb 21 08:51 mailman/pythonlib/japanese/mappings/__init__.pyc
-rw-rw-r-- 1 root mailman 158313 Sep 21  2002 mailman/pythonlib/japanese/mappings/euc_jp.py
-rw-rw-r-- 1 root mailman 139637 Dec 18  2000 mailman/pythonlib/japanese/mappings/jis_x_0212.py
-rw-rw-r-- 1 root mailman 37 Dec 19  2000 mailman/pythonlib/japanese/mappings/__init__.py
-rw-rw-r-- 1 root mailman 165780 Feb 21 08:51 mailman/pythonlib/japanese/mappings/jis_x_0208.pyc
-rw-rw-r-- 1 root mailman 165776 Feb 21 08:51 mailman/pythonlib/japanese/mappings/euc_jp.pyc
-rw-rw-r-- 1 root mailman 73 Dec 12  2000 mailman/pythonlib/japanese/jis_7.py
-rw-rw-r-- 1 root mailman 163 Feb 21 08:51 mailman/pythonlib/japanese/ms932.pyc
-rw-rw-r-- 1 root mailman 71 Dec 12  2000 mailman/pythonlib/japanese/sjis.py
-rw-rw-r-- 1 root mailman 164 Feb 21 08:51 mailman/pythonlib/japanese/sjis.pyc
-rw-rw-r-- 1 root mailman 1828 Nov 28  2004 mailman/pythonlib/japanese/c/ms932.py
-rw-rw-r-- 1 root mailman 2537 Feb 21 08:51 mailman/pythonlib/japanese/c/ms932.pyc
-rw-rw-r-- 1 root mailman 1837 Nov 28  2004 mailman/pythonlib/japanese/c/shift_jis.py
-rw-rw-r-- 1 root mailman 2549 Feb 21 08:51 mailman/pythonlib/japanese/c/shift_jis.pyc
-rw-rw-r-- 1 root mailman 3377 Feb 21 08:51 mailman/pythonlib/japanese/c/iso_2022_jp_1.pyc
-rwxrwxr-x 1 root mailman 184980 Feb 21 08:51 mailman/pythonlib/japanese/c/_japanese_codecs.so
-rw-rw-r-- 1 root mailman 2783 Nov 28  2004 mailman/pythonlib/japanese/c/iso_2022_jp_1.py
-rw-rw-r-- 1 root mailman 129 Feb 21 08:51 mailman/pythonlib/japanese/c/__init__.pyc
-rw-rw-r-- 1 root mailman 2616 Nov 28  2004 mailman/pythonlib/japanese/c/iso_2022_jp.py
-rw-rw-r-- 1 root mailman 1788 Nov 28  2004 mailman/pythonlib/japanese/c/euc_jp.py
-rw-rw-r-- 1 root mailman 38 Sep 24  2001 mailman/pythonlib/japanese/c/__init__.py
-rw-rw-r-- 1 root mailman 3191 Feb 21 08:51 mailman/pythonlib/japanese/c/iso_2022_jp.pyc
-rw-rw-r-- 1 root mailman 2971 Nov 28  2004 mailman/pythonlib/japanese/c/iso_2022_jp_ext.py
-rw-rw-r-- 1 root mailman 3442 Feb 21 08:51 mailman/pythonlib/japanese/c/iso_2022_jp_ext.pyc
-rw-rw-r-- 1 root mailman 2494 Feb 21 08:51 mailman/pythonlib/japanese/c/euc_jp.pyc
-rw-rw-r-- 1 root mailman 68 Sep 24  2002 mailman/pythonlib/japanese/windows_31j.py
-rw-rw-r-- 1 root mailman 147 Sep 24  2001 mailman/pythonlib/japanese/shift_jis.py
-rw-rw-r-- 1 root mailman 256 Feb 21 08:51 mailman/pythonlib/japanese/shift_jis.pyc
-rw-rw-r-- 1 root mailman 1014 Sep 26  2001 mailman/pythonlib/japanese/jis_x_0201_katakana.py
-rw-rw-r-- 1 root mailman 268 Feb 21 08:51 mailman/pythonlib/japanese/iso_2022_jp_1.pyc
-rw-rw-r-- 1 root mailman 155 Sep 25  2001 mailman/pythonlib/japanese/iso_2022_jp_1.py
-rw-rw-r-- 1 root mailman 161 Feb 21 08:51 mailman/pythonlib/japanese/ujis.pyc
-rw-rw-r-- 1 root mailman 201 Feb 21 08:51 mailman/pythonlib/japanese/__init__.pyc
-rw-rw-r-- 1 root mailman 151 Sep 25  2001 mailman/pythonlib/japanese/iso_2022_jp.py
-rw-rw-r-- 1 root mailman 167 Feb 21 08:51 mailman/pythonlib/japanese/jis_7.pyc
-rw-rw-r-- 1 root mailman 1769 Feb 21 08:51 mailman/pythonlib/japanese/jis_x_0201_katakana.pyc
-rw-rw-r-- 1 root mailman 4186 Nov 28  2004 mailman/pythonlib/japanese/python/shift_jis.py
-rw-rw-r-- 1 root mailman 4910 Feb 21 08:51 mailman/pythonlib/japanese/python/shift_jis.pyc
-rw-rw-r-- 1 root mailman 5629 Feb 21 08:51 mailman/pythonlib/japanese/python/iso_2022_jp_1.pyc
-rw-rw-r-- 1 root mailman 6047 Nov 28  2004 mailman/pythonlib/japanese/python/iso_2022_jp_1.py
-rw-rw-r-- 1 root mailman 134 Feb 21 08:51 mailman/pythonlib/japanese/python/__init__.pyc
-rw-rw-r-- 1 root mailman 5670 Nov 28  2004 mailman/pythonlib/japanese/python/iso_2022_jp.py
-rw-rw-r-- 1 root mailman 4842 Nov 28  2004 mailman/pythonlib/japanese/python/euc_jp.py
-rw-rw-r-- 1 root mailman 38 Sep 24  2001 mailman/pythonlib/japanese/python/__init__.py
-rw-rw-r-- 1 root mailman 5331 Feb 21 08:51 mailman/pythonlib/japanese/python/iso_2022_jp.pyc
-rw-rw-r-- 1 root mailman 6544 Nov 28  2004 mailman/pythonlib/japanese/python/iso_2022_jp_ext.py
-rw-rw-r-- 1 root mailman 5895 Feb 21 08:51 mailman/pythonlib/japanese/python/iso_2022_jp_ext.pyc
-rw-rw-r-- 1 root mailman 5243 Feb 21 08:51 mailman/pythonlib/japanese/python/euc_jp.pyc
-rw-rw-r-- 1 root mailman 167 Feb 21 08:51 mailman/pythonlib/japanese/windows_31j.pyc
-rw-rw-r-- 1 root mailman 68 Dec 12  2000 mailman/pythonlib/japanese/ujis.py
-rw-rw-r-- 1 root mailman 141 Sep 24  2001 mailman/pythonlib/japanese/euc_jp.py
-rw-rw-r-- 1 root mailman 149 Sep 30  2002 mailman/pythonlib/japanese/__init__.py
-rw-rw-r-- 1 root mailman 1737 Feb 21 08:51 mailman/pythonlib/japanese/jis_x_0201_roman.pyc
-rw-rw-r-- 1 root mailman 262 Feb 21 08:51 mailman/pythonlib/japanese/iso_2022_jp.pyc
-rw-rw-r-- 1 root mailman 159 Sep 25  2001 mailman/pythonlib/japanese/iso_2022_jp_ext.py
-rw-rw-r-- 1 root mailman 274 Feb 21 08:51 mailman/pythonlib/japanese/iso_2022_jp_ext.pyc
-rw-rw-r-- 1 root mailman 247 Feb 21 08:51 mailman/pythonlib/japanese/euc_jp.pyc
-rw-rw-r-- 1 root mailman 193062 Jul 18  2002 mailman/pythonlib/korean/mappings/uhc.py
-rw-rw-r-- 1 root mailman 113412 Jul 18  2002 mailman/pythonlib/korean/mappings/ksc5601_ideograph.py
-rw-rw-r-- 1 root mailman 117972 Feb 21 08:51 mailman/pythonlib/korean/mappings/ksc5601_ideograph.pyc
-rw-rw-r-- 1 root mailman 81094 Feb 21 08:51 mailman/pythonlib/korean/mappings/johab_ideograph.pyc
-rw-rw-r-- 1 root mailman 212685 Feb 21 08:51 mailman/pythonlib/korean/mappings/uhc.pyc
-rw-rw-r-- 1 root mailman 23707 Jul 23  2002 mailman/pythonlib/korean/mappings/ksc5601_misc.py
-rw-rw-r-- 1 root mailman 134 Feb 21 08:51 mailman/pythonlib/korean/mappings/__init__.pyc
-rw-rw-r-- 1 root mailman 23888 Feb 21 08:51 mailman/pythonlib/korean/mappings/ksc5601_misc.pyc
-rw-rw-r-- 1 root mailman 56857 Feb 21 08:51 mailman/pythonlib/korean/mappings/ksc5601_hangul.pyc
-rw-rw-r-- 1 root mailman 55035 Jul 18  2002 mailman/pythonlib/korean/mappings/ksc5601_hangul.py
-rw-rw-r-- 1 root mailman 78253 Jul 18  2002 mailman/pythonlib/korean/mappings/johab_ideograph.py
-rw-rw-r-- 1 root mailman 882 Jul 18  2002 mailman/pythonlib/korean/mappings/__init__.py
-rw-rw-r-- 1 root mailman 991 Jul 18  2002 mailman/pythonlib/korean/qwerty2bul.py
-rw-rw-r-- 1 root mailman 253 Feb 21 08:51 mailman/pythonlib/korean/qwerty2bul.pyc
-rw-rw-r-- 1 root mailman 241 Feb 21 08:51 mailman/pythonlib/korean/euc_kr.pyc
-rwxrwxr-x 1 root mailman 467596 Feb 21 08:51 mailman/pythonlib/korean/c/_koco.so
-rw-rw-r-- 1 root mailman 889 Feb 21 08:51 mailman/pythonlib/korean/c/euc_kr.pyc
-rw-rw-r-- 1 root mailman 885 Feb 21 08:51 mailman/pythonlib/korean/c/cp949.pyc
-rw-rw-r-- 1 root mailman 127 Feb 21 08:51 mailman/pythonlib/korean/c/__init__.pyc
-rw-rw-r-- 1 root mailman 1268 Jul 18  2002 mailman/pythonlib/korean/c/euc_kr.py
-rw-rw-r-- 1 root mailman 882 Jul 18  2002 mailman/pythonlib/korean/c/__init__.py
-rw-rw-r-- 1 root mailman 1264 Jul 18  2002 mailman/pythonlib/korean/c/cp949.py
-rwxrwxr-x 1 root mailman 16060 Feb 21 08:51 mailman/pythonlib/korean/c/hangul.so
-rw-rw-r-- 1 root mailman 238 Feb 21 08:51 mailman/pythonlib/korean/cp949.pyc
-rw-rw-r-- 1 root mailman 125 Feb 21 08:51 mailman/pythonlib/korean/__init__.pyc
-rw-rw-r-- 1 root mailman 967 Jul 18  2002 mailman/pythonlib/korean/hangul.py
-rw-rw-r-- 1 root mailman 979 Jul 18  2002 mailman/pythonlib/korean/euc_kr.py
-rw-rw-r-- 1 root mailman 247 Feb 21 08:51 mailman/pythonlib/korean/unijohab.pyc
-rw-rw-r-- 1 root mailman 7208 Jul 18  2002 mailman/pythonlib/korean/python/qwerty2bul.py
-rw-rw-r-- 1 root mailman 6112 Feb 21 08:51 mailman/pythonlib/korean/python/qwerty2bul.pyc
-rw-rw-r-- 1 root mailman 4567 Feb 21 08:51 mailman/pythonlib/korean/python/euc_kr.pyc
-rw-rw-r-- 1 root mailman 355 Feb 21 08:51 mailman/pythonlib/korean/python/cp949.pyc
-rw-rw-r-- 1 root mailman 132 Feb 21 08:51 mailman/pythonlib/korean/python/__init__.pyc
-rw-rw-r-- 1 root mailman 10404 Jul 18  2002 mailman/pythonlib/korean/python/hangul.py
-rw-rw-r-- 1 root mailman 5682 Jul 18  2002 mailman/pythonlib/korean/python/euc_kr.py
-rw-rw-r-- 1 root mailman 1536 Feb 21 08:51 mailman/pythonlib/korean/python/unijohab.pyc
-rw-rw-r-- 1 root mailman 1758 Jul 18  2002 mailman/pythonlib/korean/python/unijohab.py
-rw-rw-r-- 1 root mailman 6366 Feb 21 08:51 mailman/pythonlib/korean/python/johab.pyc
-rw-rw-r-- 1 root mailman 882 Jul 18  2002 mailman/pythonlib/korean/python/__init__.py
-rw-rw-r-- 1 root mailman 1034 Jul 18  2002 mailman/pythonlib/korean/python/cp949.py
-rw-rw-r-- 1 root mailman 6873 Jul 18  2002 mailman/pythonlib/korean/python/iso_2022_kr.py
-rw-rw-r-- 1 root mailman 4395 Feb 21 08:51 mailman/pythonlib/korean/python/iso_2022_kr.pyc
-rw-rw-r-- 1 root mailman 9830 Feb 21 08:51 mailman/pythonlib/korean/python/hangul.pyc
-rw-rw-r-- 1 root mailman 7166 Jul 18  2002 mailman/pythonlib/korean/python/johab.py
-rw-rw-r-- 1 root mailman 985 Jul 18  2002 mailman/pythonlib/korean/unijohab.py
-rw-rw-r-- 1 root mailman 238 Feb 21 08:51 mailman/pythonlib/korean/johab.pyc
-rw-rw-r-- 1 root mailman 882 Jul 18  2002 mailman/pythonlib/korean/__init__.py
-rw-rw-r-- 1 root mailman 711 Feb 21 08:51 mailman/pythonlib/korean/aliases.pyc
-rw-rw-r-- 1 root mailman 976 Jul 18  2002 mailman/pythonlib/korean/cp949.py
-rw-rw-r-- 1 root mailman 1595 Jul 18  2002 mailman/pythonlib/korean/aliases.py
-rw-rw-r-- 1 root mailman 994 Jul 18  2002 mailman/pythonlib/korean/iso_2022_kr.py
-rw-rw-r-- 1 root mailman 256 Feb 21 08:51 mailman/pythonlib/korean/iso_2022_kr.pyc
-rw-rw-r-- 1 root mailman 213 Feb 21 08:51 mailman/pythonlib/korean/hangul.pyc
-rw-rw-r-- 1 root mailman 976 Jul 18  2002 mailman/pythonlib/korean/johab.py
-rw-rw-r-- 1 root mailman 822 Feb 21 08:51 mailman/pythonlib/email/MIMENonMultipart.pyc
-rw-rw-r-- 1 root mailman 686 Jun 12  2006 mailman/pythonlib/email/Iterators.py
-rw-rw-r-- 1 root mailman 1576 Feb 21 08:51 mailman/pythonlib/email/MIMEMultipart.pyc
-rw-rw-r-- 1 root mailman 2611 Feb 21 08:51 mailman/pythonlib/email/Encoders.pyc
-rw-rw-r-- 1 root mailman 5866 Jun 12  2006 mailman/pythonlib/email/base64MIME.py
-rw-rw-r-- 1 root mailman 7686 Feb 21 08:51 mailman/pythonlib/email/Parser.pyc
-rw-rw-r-- 1 root mailman 1033 Feb 21 08:51 mailman/pythonlib/email/MIMEBase.pyc
-rw-rw-r-- 1 root mailman 1198 Feb 21 08:51 mailman/pythonlib/email/Errors.pyc
-rw-rw-r-- 1 root mailman 2116 Jun 12  2006 mailman/pythonlib/email/_compat22.py
-rw-rw-r-- 1 root mailman 2589 Feb 21 08:51 mailman/pythonlib/email/_compat22.pyc
-rw-rw-r-- 1 root mailman 21985 Jun 12  2006 mailman/pythonlib/email/Header.py
-rw-rw-r-- 1 root mailman 30239 Feb 21 08:51 mailman/pythonlib/email/Message.pyc
-rw-rw-r-- 1 root mailman 1749 Jun 12  2006 mailman/pythonlib/email/MIMEImage.py
-rw-rw-r-- 1 root mailman 16129 Jun 12  2006 mailman/pythonlib/email/Charset.py
-rw-rw-r-- 1 root mailman 13265 Feb 21 08:51 mailman/pythonlib/email/_parseaddr.pyc
-rw-rw-r-- 1 root mailman 11026 Jul 25  2006 mailman/pythonlib/email/Utils.py
-rw-rw-r-- 1 root mailman 13628 Feb 21 08:51 mailman/pythonlib/email/Charset.pyc
-rw-rw-r-- 1 root mailman 10381 Feb 21 08:51 mailman/pythonlib/email/Utils.pyc
-rw-rw-r-- 1 root mailman 1793 Feb 21 08:51 mailman/pythonlib/email/__init__.pyc
-rw-rw-r-- 1 root mailman 2533 Jun 12  2006 mailman/pythonlib/email/Encoders.py
-rw-rw-r-- 1 root mailman 1900 Feb 21 08:51 mailman/pythonlib/email/MIMEText.pyc
-rw-rw-r-- 1 root mailman 1377 Feb 21 08:51 mailman/pythonlib/email/MIMEMessage.pyc
-rw-rw-r-- 1 root mailman 14135 Feb 21 08:51 mailman/pythonlib/email/Header.pyc
-rw-rw-r-- 1 root mailman 1244 Jun 12  2006 mailman/pythonlib/email/MIMEMessage.py
-rw-rw-r-- 1 root mailman 14085 Jun 12  2006 mailman/pythonlib/email/Generator.py
-rw-rw-r-- 1 root mailman 595 Jun 12  2006 mailman/pythonlib/email/Errors.py
-rw-rw-r-- 1 root mailman 2598 Jun 12  2006 mailman/pythonlib/email/MIMEAudio.py
-rw-rw-r-- 1 root mailman 756 Jun 12  2006 mailman/pythonlib/email/MIMEBase.py
-rw-rw-r-- 1 root mailman 12804 Jun 12  2006 mailman/pythonlib/email/Parser.py
-rw-rw-r-- 1 root mailman 2666 Feb 21 08:51 mailman/pythonlib/email/_compat21.pyc
-rw-rw-r-- 1 root mailman 703 Jun 12  2006 mailman/pythonlib/email/MIMENonMultipart.py
-rw-rw-r-- 1 root mailman 1879 Jul 25  2006 mailman/pythonlib/email/__init__.py
-rw-rw-r-- 1 root mailman 1329 Jun 12  2006 mailman/pythonlib/email/MIMEMultipart.py
-rw-rw-r-- 1 root mailman 917 Feb 21 08:51 mailman/pythonlib/email/Iterators.pyc
-rw-rw-r-- 1 root mailman 10647 Feb 21 08:51 mailman/pythonlib/email/Generator.pyc
-rw-rw-r-- 1 root mailman 10601 Jun 12  2006 mailman/pythonlib/email/quopriMIME.py
-rw-rw-r-- 1 root mailman 14899 Jun 14  2010 mailman/pythonlib/email/_parseaddr.py
-rw-rw-r-- 1 root mailman 2922 Feb 21 08:51 mailman/pythonlib/email/MIMEAudio.pyc
-rw-rw-r-- 1 root mailman 2263 Jun 12  2006 mailman/pythonlib/email/_compat21.py
-rw-rw-r-- 1 root mailman 1841 Jun 12  2006 mailman/pythonlib/email/MIMEText.py
-rw-rw-r-- 1 root mailman 2046 Feb 21 08:51 mailman/pythonlib/email/MIMEImage.pyc
-rw-rw-r-- 1 root mailman 5625 Feb 21 08:51 mailman/pythonlib/email/base64MIME.pyc
-rw-rw-r-- 1 root mailman 8793 Feb 21 08:51 mailman/pythonlib/email/quopriMIME.pyc
-rw-rw-r-- 1 root mailman 33037 Jun 12  2006 mailman/pythonlib/email/Message.py


Version-Release number of selected component (if applicable):
mailman-2.1.9-6.el5_6.1.i386

How reproducible:
always

Comment 3 Petr Kovar 2011-06-28 13:34:39 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Previously, a number of Python scripts and subdirectories in the /usr/lib/mailman/ directory were group writable. As a result, the respective files and subdirectories could have been changed not only by the owner, but also by other users in the same user group. This undesired behavior has been resolved in this update so that only the owner can now change the files and subdirectories.

Comment 6 errata-xmlrpc 2011-09-07 13:06:17 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-1275.html

Note You need to log in before you can comment on or make changes to this bug.