PT-2004-1105 · Webmin · Usermin+1

Published 2004-09-12 · Updated 2017-07-11 · CVE-2004-1468

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Usermin versions 1.x Webmin versions 1.x Usermin versions prior to 1.090

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail message, potentially leading to disruption of confidentiality, integrity, and availability of protected information. This can be exploited remotely.

Recommendations For Usermin versions 1.x, update to a version later than 1.090 to resolve the issue. For Webmin versions 1.x, update to a version later than 1.090 to resolve the issue. For Usermin versions prior to 1.090, update to version 1.090 or later to resolve the issue. As a temporary workaround, consider restricting access to the web mail functionality in Usermin and Webmin until a patch is available.

Exploit

Fix

Related Identifiers

BDU:2015-09457

CVE-2004-1468

Affected Products

Usermin

Webmin

References · 8

• 🔥 http://securityfocus.com/bid/11122 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1468 · Security Note
• http://secunia.com/advisories/12488 · Patch
• https://bdu.fstec.ru/vul/2015-09457 · Security Note
• http://lac.co.jp/security/csl/intelligence/SNSadvisory_e/77_e.html · Note
• http://security.gentoo.org/glsa/glsa-200409-15.xml · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17293 · Note
• http://gentoo.org/security/en/glsa/glsa-200409-15.xml · Patch, Vendor Advisory