From: snsadv (snsadvlac.co.jp)
Date: Fri Jun 11 2004 - 03:24:34 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----------------------------------------------------------------------
SNS Advisory No.74
Webmin Access Control Rule Bypass Vulnerability

Problem first discovered on: Sun, 11 Apr 2004
Published on: Fri, 11 Jun 2004
----------------------------------------------------------------------

Overview:
---------
  Webmin is prone to a vulnerability that allows attackers to read
  module settings.

Problem Description:
--------------------
  Webmin is a web-based system administration tool for Unix.

  A vulnerability exists that could allow users to gain read access to
  the configuration of a module used by Webmin without authentication.

Tested Versions:
----------------
  Webmin Version 1.140

Solution:
---------
  This problem can be eliminated by upgrading to Webmin version 1.150,
  which is available at:

    http://www.webmin.com/

Discovered by:
--------------
  Keigo Yamazaki

Acknowledgements:
-----------------

  Thanks to:
  Mr. Jamie Cameron

Disclaimer:
-----------
  The information contained in this advisory may be revised without prior
  notice and is provided as it is. Users shall take their own risk when
  taking any actions following reading this advisory. LAC Co., Ltd. shall
  take no responsibility for any problems, loss or damage caused by, or by
  the use of information provided here.

  This advisory can be found at the following URL:
  http://www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/74_e.html

------------------------------------------------------------------
Secure Net Service(SNS) Security Advisory <snsadvlac.co.jp>
Computer Security Laboratory, LAC http://www.lac.co.jp/security/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]