PT-2004-1104 · Webmin · Usermin

Published 2004-09-12 · Updated 2017-07-11 · CVE-2004-0559

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Usermin versions 1.070 through 1.080 Usermin versions prior to 1.090

Description The issue allows local users to overwrite arbitrary files at install time via a symlink attack on the /tmp/.usermin directory. Multiple vulnerabilities in the usermin package can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.

Recommendations For versions 1.070 and 1.080, consider updating to a version later than 1.080 to mitigate the risk. For versions prior to 1.090, update to version 1.090 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp/.usermin directory to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09457

CVE-2004-0559

DSA-544-1

Affected Products

Usermin

References · 8

• http://securityfocus.com/bid/11153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0559 · Security Note
• http://secunia.com/advisories/12488 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09457 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200409-15.xml · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17299 · Note
• http://security.gentoo.org/glsa/glsa-200409-15.xml · Note
• http://webmin.com/uchanges-1.089.html · Note