Webmin/Usermin vulnerabilities [LWN.net]

Package(s):

webmin

CVE #(s):

Created:

May 21, 2002

Updated:

January 10, 2003

Description:

Webmin is a web-based interface for system administration for Unix. Webmin has cross-site scripting and session ID spoofing vulnerabilities which are fixed in the May 6, 2002 release of version 0.970. (First LWN report: May 9).

This one is scary. The session ID spoofing vulnerability allows the "possibility that arbitrary commands may be executed with root privileges." Upgrading is strongly recommended. At a minimum avoid the "preconditions for a successful exploit" by disabling password timeouts under Webmin->Configuration->Authentication.

Alerts:

SCO Group	CSSA-2003-002.0	2003-01-09
Yellow Dog	YDU-20020522-7	2002-05-22
Mandrake	MDKSA-2002:033	2002-05-21

(Log in to post comments)

Webmin/Usermin vulnerabilities

Posted Jun 1, 2002 1:58 UTC (Sat) by rjamestaylor (guest, #339) [Link]

A seasoned Unix admin told me to avoid remote admin tools, especially web-based ones, at any cost. I didn't listen but with the revelation that such a security hole has existed until now (!) I have lost confidence in Webmin for the foreseeable future.