COMMAND

    Lyris

SYSTEMS AFFECTED

    Lyris List Manager Administration

PROBLEM

    Adam Hupp found  following.  Versions  3 and 4  of the Lyris  List
    Manager allow any  mailing list subscriber  to gain access  to the
    administrative interface of  that list.   After a user  has logged
    in, they  may modify  the generated  web page  as follows  to gain
    access.

    Save the html to  disk, and add the  full path to the  server into
    the FORM tag.   This allows it  to be submitted  when loaded  from
    disk.  Next change the value of

        <INPUT TYPE="hidden" NAME="list_admin" VALUE="F">

    to a "T".   When the page is  loaded back in the  browser the user
    has complete access to all list administrator functions.

SOLUTION

    Lyris has been notified, and a fix is available at

        http://www.lyris.com/lm/lm_updates.html