PT-2005-4652 · Usermin+1 · Usermin+2

Jack Louis · Published 2005-11-30 · Updated 2019-04-03 · CVE-2005-3912

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 1.250 Usermin versions prior to 1.180

Description A format string issue in the miniserv.pl Perl web server allows remote attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in the username parameter to the login form, which is used in a syslog call.

Recommendations For Webmin versions prior to 1.250, update to version 1.250 or later to resolve the issue. For Usermin versions prior to 1.180, update to version 1.180 or later to resolve the issue. As a temporary workaround, consider disabling syslog logging in miniserv.pl until a patch is available. Restrict access to the login form to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-3912

DSA-1199-1

Affected Products

Usermin

Webmin

Miniserv.Pl

References · 18

• http://lists.immunitysec.com/pipermail/dailydave/2005-November/002685.html · Patch
• http://webmin.com/uchanges-1.180.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200512-02.xml · Vendor Advisory
• http://secunia.com/advisories/17749 · Patch
• http://dyadsecurity.com/webmin-0001.html · Patch
• http://debian.org/security/2006/dsa-1199 · Vendor Advisory
• http://webmin.com/security.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_30_sr.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2005:223 · Vendor Advisory
• http://webmin.com/changes-1.250.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3912 · Security Note
• http://secunia.com/advisories/17817 · Note
• http://securityfocus.com/archive/1/418093/100/0/threaded · Note
• http://secunia.com/advisories/18101 · Note
• http://secunia.com/advisories/17878 · Note