PT-2004-1104 · Webmin · Usermin

Publicado 2004-09-12 · Atualizado 2017-07-11 · CVE-2004-0559

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Usermin versions 1.070 through 1.080 Usermin versions prior to 1.090

Description The issue allows local users to overwrite arbitrary files at install time via a symlink attack on the /tmp/.usermin directory. Multiple vulnerabilities in the usermin package can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.

Recommendations For versions 1.070 and 1.080, consider updating to a version later than 1.080 to mitigate the risk. For versions prior to 1.090, update to version 1.090 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp/.usermin directory to minimize the risk of exploitation.

Correção

Identificadores relacionados

BDU:2015-09457

CVE-2004-0559

DSA-544-1

Produtos afetados

Usermin

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/17299 · Nota
• http://securityfocus.com/bid/11153 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-0559 · Nota de Segurança
• http://secunia.com/advisories/12488 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200409-15.xml · Nota
• http://webmin.com/uchanges-1.089.html · Nota
• https://bdu.fstec.ru/vul/2015-09457 · Nota de Segurança
• http://gentoo.org/security/en/glsa/glsa-200409-15.xml · Aviso do Fabricante