idefense.webmin.txt

Reference: http://www.securiteam.com/unixfocus/5CP0R1P80G.html Webmin Vulnerability Leads to Remote Compromise RPC CGI ------------------------------------------------------------------------ SUMMARY Webmin is a web-based interface for system administration for Linux/UNIX. Using any browser that...

Webmin Vulnerability Leads to Remote Compromise (RPC CGI)

Reference: http://www.securiteam.com/unixfocus/5CP0R1P80G.html Webmin Vulnerability Leads to Remote Compromise RPC CGI ------------------------------------------------------------------------ SUMMARY http://www.webmin.com Webmin is a web-based interface for system administration for Linux/UNIX...

Webmin 0.x - RPC Privilege Escalation

Webmin 0.x - RPC Privilege Escalation source: https://www.securityfocus.com/bid/5591/info In cases where users of Webmin do not have root access on the underlying host, it may be possible to mount privilege escalation attacks on the underlying host. This normally occurs in configurations where...

Webmin 0.x - 'RPC' Privilege Escalation

source: https://www.securityfocus.com/bid/5591/info In cases where users of Webmin do not have root access on the underlying host, it may be possible to mount privilege escalation attacks on the underlying host. This normally occurs in configurations where multiple Webmin client systems have acce...

CVE-2002-0756

Cross-site scripting vulnerability in the authentication page for 1 Webmin 0.96 and 2 Usermin 0.90 allows remote attackers to insert script into an error page and possibly steal cookies...

CVE-2002-0757

1 Webmin 0.96 and 2 Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID...

CVE-2002-0756

CVE-2002-0756 is a cross-site scripting vulnerability on the authentication page for Webmin 0.96 and Usermin 0.90. The flaw allows remote attackers to inject scripts into an error page and potentially steal cookies. The NVD record assigns CVSSv2 base score 7.5 (HIGH) with network attack vector an...

CVE-2002-0757

CVE-2002-0757 affects Webmin 0.96 and Usermin 0.90 (password timeouts enabled), enabling authentication bypass by sending certain control characters in authentication data to force acceptance of arbitrary username/session IDs. The issue allows local and possibly remote attackers to gain privilege...

CVE-2002-0756

Cross-site scripting vulnerability in the authentication page for 1 Webmin 0.96 and 2 Usermin 0.90 allows remote attackers to insert script into an error page and possibly steal cookies...

CVE-2002-0757

1 Webmin 0.96 and 2 Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID...

CVE-2002-0756: Undefined Security Weakness

Cross-site scripting vulnerability in the authentication page for 1 Webmin 0.96 and 2 Usermin 0.90 allows remote attackers to insert script into an error page and possibly steal cookies...

CVE-2002-0757: Undefined Security Weakness

1 Webmin 0.96 and 2 Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID...

CVE-2001-1074

Webmin 0.84 and earlier does not properly clear the HTTPAUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges...

CVE-2001-1074

Summary: CVE-2001-1074 affects Webmin 0.84 and earlier. The vulnerability arises because Webmin does not properly clear the HTTP_AUTHORIZATION environment variable when the web server restarts, causing authentication information to be exposed to all CGI programs and enabling local privilege escal...

CVE-2001-1074: Undefined Security Weakness

Webmin 0.84 and earlier does not properly clear the HTTPAUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges...

[SNS Advisory No.53] Webmin/Usermin Session ID Spoofing Vulnerability

---------------------------------------------------------------------- SNS Advisory No.53 Webmin/Usermin Session ID Spoofing Vulnerability Problem first discovered: Sat, 4 May 2002 Published: Tue, 7 May 2002 ---------------------------------------------------------------------- Overview: --------...

[SNS Advisory No.52] Webmin/Usermin Cross-site Scripting Vulnerability

---------------------------------------------------------------------- SNS Advisory No.52 Webmin/Usermin Cross-site Scripting Vulnerability Problem first discovered: Thu, 2 May 2002 Published: Tue, 7 May 2002 ---------------------------------------------------------------------- Overview: -------...

Privelege escalation using webmin log files

Unsafe permissions of log files allows to steal cookie of system administrators and to get web access to administration with root permissions...

Local privalege escalation issues with Webmin 0.92

18-02-02 -- [email protected] About Webmin: ------------- "Webmin is a web-based interface for system administration for Unix. Using any browser that supports tables and forms and Java for the File Manager module, you can setup user accounts, Apache, DNS, file sharing and so on." Problem 1...

Webmin 0.x - Code Input Validation

Webmin 0.x - Code Input Validation source: https://www.securityfocus.com/bid/4329/info Webmin is a web-based interface for system administration of Unix and Linux operating systems. Webmin does not filter script code from output that may be displayed by the web interface, such as log files, etc...