Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: [Full-disclosure] re: webmin remote format string bug
From: Dave Aitel (daveimmunitysec.com)
Date: Thu Dec 01 2005 - 15:10:33 CST
This is exploitable - Immunity has a PoC exploit in our Partner's
section written by Bas Alberts.
> I succeeded in crashing webmin 1.230 with:
> username %n
> password aaaa
> after klicking 4 times on "Login" webmin was dead.
> There were no logs at all, and no error was shown in the web interface...
> Any idea if it's really exploitable (executing code I mean)? Is anyone working on a POC?
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/