PT-2003-1367 · Webmin · Usermin+1

Cintia M. Imanishi · Published 2003-02-26 · Updated 2016-10-18 · CVE-2003-0101

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 1.070 Usermin versions prior to 1.000

Description The issue arises from the improper handling of metacharacters, such as line feeds and carriage returns (CRLF), in Base-64 encoded strings during Basic authentication. This allows remote attackers to spoof a session ID, potentially leading to the gain of root privileges.

Recommendations For Webmin versions prior to 1.070, update to version 1.070 or later to resolve the issue. For Usermin versions prior to 1.000, update to version 1.000 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2003-0101

DSA-319

Affected Products

Usermin

Webmin

References · 19

• 🔥 https://exploit-db.com/exploits/22275 · Exploit
• http://debian.org/security/2003/dsa-319 · Vendor Advisory
• http://iss.net/security_center/static/11390.php · Vendor Advisory
• http://archives.neohapsis.com/archives/linux/engarde/2003-q1/0008.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2003:025 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0101 · Security Note
• http://archives.neohapsis.com/archives/hp/2003-q1/0063.html · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20030602-01-I · Vendor Advisory
• http://securitytracker.com/id?1006160 · Note
• http://secunia.com/advisories/8163 · Note
• http://marc.info/?l=bugtraq&m=104610245624895&w=2 · Note
• http://lac.co.jp/security/english/snsadv_e/62_e.html · Note
• http://securityfocus.com/bid/6915 · Note
• http://marc.info/?l=webmin-announce&m=104587858408101&w=2 · Note
• http://marc.info/?l=bugtraq&m=104610300325629&w=2 · Note