CVE-2005-3042
Summary
| CVE | CVE-2005-3042 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2005-09-22 10:03:00 UTC |
| Updated | 2011-03-08 02:25:00 UTC |
| Description | miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters (line feed or carriage return). |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Advisories - Mandriva | MANDRIVA | www.mandriva.com | |
| JVN#40940493: Webmin および Usermin における認証回避の脆弱性 | JVN | jvn.jp | |
| セキュリティ対策のラック｜情報を守るセキュリティ対策のパイオニア | MISC | www.lac.co.jp | Patch, Vendor Advisory |
| Secunia - Advisories - Webmin / Usermin PAM Authentication Bypass Vulnerability | SECUNIA | secunia.com | Patch, Vendor Advisory |
| Webmin/Usermin PAM Authentication Bypass Vulnerability - SecurityReason.com | SREASON | securityreason.com | |
| Changes since Webmin version 1.220 | CONFIRM | www.webmin.com | Patch |
| Neohapsis Archives - Bugtraq - #0257 - [SNS Advisory No.83] Webmin/Usermin PAM Authentication Bypass Vulnerability | BUGTRAQ | archives.neohapsis.com | Patch, Vendor Advisory |
| Security Announcement | SUSE | www.novell.com | |
| Changes since Usermin version 1.150 | CONFIRM | www.webmin.com | |
| Gentoo Linux Documentation -- Webmin, Usermin: Remote code execution through PAM authentication | GENTOO | www.gentoo.org | |
| Secunia - Advisories - SUSE Updates for Multiple Packages | SECUNIA | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| 19575 | OSVDB | www.osvdb.org | |
| Webmin / Usermin Remote PAM Authentication Bypass Vulnerability | BID | www.securityfocus.com | |
| JVN:JVN#40940493 | MITRE | jvn.jp | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.