Ecartis is "an open-source (GNU License) software package that administers mailing lists (similar to Majordomo and Listserv)". Several security vulnerabilities have been found in the product allowing remote attackers to execute arbitrary code, and to remotely cause the product to reveal to them the administrative password used by Ecartis' administrator.
Credit:
The information has been provided by Timo Sirainen.
Password disclosure:
Ecartis contains liscript that supports some variables and functions. User input is fully trusted in several places that allow calling those functions or viewing variables.
For example, send an email to ecartis@host.com:
subscribe secret-list
subscribe <$post-password>
The first command will fail, but it selects the secret-list as an active list. Second command will also fail, but the reply mail expands the post-password to the real password.
Multiple Buffer Overflows:
The product contains multiple buffer overflows. These have been fixed by the provided (unofficial) patch:
