PT-2002-1778 · Webmin+1 · Webmin+1

Published 2002-07-26 · Updated 2008-09-05 · CVE-2002-0757

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Webmin version 0.96 Usermin version 0.90

Description The issue allows local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information. This can force the software to accept arbitrary username/session ID combinations.

Recommendations For Webmin version 0.96, update to a version that does not have the password timeout enabled or apply a configuration change to disable the vulnerable authentication mechanism. For Usermin version 0.90, update to a version that does not have the password timeout enabled or apply a configuration change to disable the vulnerable authentication mechanism. As a temporary workaround, consider restricting access to the authentication module to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-0757

Affected Products

Usermin

Webmin

References · 5

• 🔥 http://online.securityfocus.com/archive/1/271466 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0757 · Security Note
• http://iss.net/security_center/static/9037.php · Vendor Advisory
• http://securityfocus.com/bid/4700 · Vendor Advisory
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-033.php · Patch, Vendor Advisory