PT-2005-4652 · Usermin+1 · Usermin+2

Jack Louis · Publicado 2005-11-30 · Atualizado 2019-04-03 · CVE-2005-3912

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 1.250 Usermin versions prior to 1.180

Description A format string issue in the miniserv.pl Perl web server allows remote attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in the username parameter to the login form, which is used in a syslog call.

Recommendations For Webmin versions prior to 1.250, update to version 1.250 or later to resolve the issue. For Usermin versions prior to 1.180, update to version 1.180 or later to resolve the issue. As a temporary workaround, consider disabling syslog logging in miniserv.pl until a patch is available. Restrict access to the login form to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-3912

DSA-1199-1

Produtos afetados

Usermin

Webmin

Miniserv.Pl

Referências · 18

• http://lists.immunitysec.com/pipermail/dailydave/2005-November/002685.html · Correção
• http://secunia.com/advisories/17817 · Nota
• http://securityfocus.com/archive/1/418093/100/0/threaded · Nota
• http://webmin.com/uchanges-1.180.html · Aviso do Fabricante
• http://gentoo.org/security/en/glsa/glsa-200512-02.xml · Aviso do Fabricante
• http://secunia.com/advisories/17749 · Correção
• http://dyadsecurity.com/webmin-0001.html · Correção
• http://debian.org/security/2006/dsa-1199 · Aviso do Fabricante
• http://webmin.com/security.html · Aviso do Fabricante
• http://secunia.com/advisories/18101 · Nota
• http://secunia.com/advisories/17878 · Nota
• http://novell.com/linux/security/advisories/2005_30_sr.html · Aviso do Fabricante
• http://secunia.com/advisories/22556 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2005:223 · Aviso do Fabricante
• http://webmin.com/changes-1.250.html · Aviso do Fabricante