CVE-2003-0101
Summary
| CVE | CVE-2003-0101 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2003-03-03 05:00:00 UTC |
| Updated | 2016-10-18 02:29:00 UTC |
| Description | miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Engardelinux | Guardian Digital Webtool | 1.2 | All | All | All |
| Application | Engardelinux | Guardian Digital Webtool | 1.2 | All | All | All |
| Application | Usermin | Usermin | 0.4 | All | All | All |
| Application | Usermin | Usermin | 0.5 | All | All | All |
| Application | Usermin | Usermin | 0.6 | All | All | All |
| Application | Usermin | Usermin | 0.7 | All | All | All |
| Application | Usermin | Usermin | 0.8 | All | All | All |
| Application | Usermin | Usermin | 0.9 | All | All | All |
| Application | Usermin | Usermin | 0.91 | All | All | All |
| Application | Usermin | Usermin | 0.92 | All | All | All |
| Application | Usermin | Usermin | 0.93 | All | All | All |
| Application | Usermin | Usermin | 0.94 | All | All | All |
| Application | Usermin | Usermin | 0.95 | All | All | All |
| Application | Usermin | Usermin | 0.96 | All | All | All |
| Application | Usermin | Usermin | 0.97 | All | All | All |
| Application | Usermin | Usermin | 0.98 | All | All | All |
| Application | Usermin | Usermin | 0.99 | All | All | All |
| Application | Usermin | Usermin | 0.4 | All | All | All |
| Application | Usermin | Usermin | 0.5 | All | All | All |
| Application | Usermin | Usermin | 0.6 | All | All | All |
| Application | Usermin | Usermin | 0.7 | All | All | All |
| Application | Usermin | Usermin | 0.8 | All | All | All |
| Application | Usermin | Usermin | 0.9 | All | All | All |
| Application | Usermin | Usermin | 0.91 | All | All | All |
| Application | Usermin | Usermin | 0.92 | All | All | All |
| Application | Usermin | Usermin | 0.93 | All | All | All |
| Application | Usermin | Usermin | 0.94 | All | All | All |
| Application | Usermin | Usermin | 0.95 | All | All | All |
| Application | Usermin | Usermin | 0.96 | All | All | All |
| Application | Usermin | Usermin | 0.97 | All | All | All |
| Application | Usermin | Usermin | 0.98 | All | All | All |
| Application | Usermin | Usermin | 0.99 | All | All | All |
| Application | Webmin | Webmin | 1.0.50 | All | All | All |
| Application | Webmin | Webmin | 1.0.60 | All | All | All |
| Application | Webmin | Webmin | 1.0.50 | All | All | All |
| Application | Webmin | Webmin | 1.0.60 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| SecureNet Service: SNS Advisory | MISC | www.lac.co.jp | |
| Secunia - Advisories - Mandrake updates for webmin | SECUNIA | secunia.com | |
| Debian -- Security Information -- DSA-319-1 webmin | DEBIAN | www.debian.org | |
| SecurityTracker.com Archives - Webmin Input Validation Flaw in 'miniserv.pl' May Let Remote Users Spoof Session IDs and Gain Root Access | SECTRACK | www.securitytracker.com | |
| ISS X-Force Database:webmin-usermin-root-access(11390): Webmin and Usermin session ID spoofing root access | XF | www.iss.net | Vendor Advisory |
| Secunia - Advisories - Webmin Authentication Bypass Vulnerability | SECUNIA | secunia.com | |
| Neohapsis Archives - HP Security Digests - #0063 - HP-UX security bulletins digest | HP | archives.neohapsis.com | |
| LinuxSecurity.com: Gentoo: webmin Unauthorized access vulnerability | CONFIRM | www.linuxsecurity.com | |
| Advisories - Mandriva | MANDRAKE | www.mandriva.com | |
| 'Webmin 1.050 - 1.060 remote exploit' - MARC | BUGTRAQ | marc.info | |
| N-058: Vulnerabilities in Webmin/Usermin | CIAC | www.ciac.org | |
| '[SNS Advisory No.62] Webmin/Usermin Session ID Spoofing Vulnerability "Episode 2"' - MARC | BUGTRAQ | marc.info | |
| 'GLSA: usermin (200302-14)' - MARC | BUGTRAQ | marc.info | |
| Neohapsis Archives - EnGarde security advisories - [ESA-20030225-006] WebTool session ID spoofing vulnerability. - From engarde-announce-admins_at_guardiandigital.com | ENGARDE | archives.neohapsis.com | |
| Webmin/Usermin Session ID Spoofing Unauthenticated Access Vulnerability | BID | www.securityfocus.com | |
| 'Webmin version 1.070 released - fixes security hole' - MARC | CONFIRM | marc.info | |
| 20030602-01-I | SGI | patches.sgi.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.