BID:10474

Webmin Multiple Unspecified Vulnerabilities

Info

Webmin Multiple Unspecified Vulnerabilities

Bugtraq ID:	10474
Class:	Unknown
CVE:	CVE-2004-0582 CVE-2004-0583
Remote:	Yes
Local:	No
Published:	Jun 07 2004 12:00AM
Updated:	Jul 12 2009 05:16AM
Credit:	These issues were reported in the Webmin change log.
Vulnerable:	Webmin Webmin 1.140 Webmin Webmin 1.130 Webmin Webmin 1.121 Webmin Webmin 1.110 Webmin Webmin 1.0 90 Webmin Webmin 1.0 80 Webmin Webmin 1.0 70 + HP Apache-Based Web Server 1.3.27 .01 + HP Apache-Based Web Server 1.3.27 .01 + HP Webmin-Based Admin 1.0.1 .01 + HP Webmin-Based Admin 1.0.1 .01 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 8.0 Webmin Webmin 1.0 60 Webmin Webmin 1.0 50 Webmin Webmin 1.0 20 Webmin Webmin 1.0 00 Webmin Webmin 0.990 Webmin Webmin 0.980 Webmin Webmin 0.970 Webmin Webmin 0.960 Webmin Webmin 0.950 Webmin Webmin 0.94 Webmin Webmin 0.93 Webmin Webmin 0.92 -1 Webmin Webmin 0.92 Webmin Webmin 0.91 Webmin Webmin 0.89 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + Caldera OpenLinux Workstation 3.1 + Caldera OpenLinux Workstation 3.1 Webmin Webmin 0.88 Webmin Webmin 0.85 - Caldera OpenLinux 2.4 - Caldera OpenLinux 2.4 - Caldera OpenLinux 2.3 - Caldera OpenLinux 2.3 - MandrakeSoft Corporate Server 1.0.1 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.1 Webmin Webmin 0.80 Webmin Webmin 0.79 Webmin Webmin 0.78 Webmin Webmin 0.77 Webmin Webmin 0.76 Webmin Webmin 0.51 Webmin Webmin 0.42 Webmin Webmin 0.41 Webmin Webmin 0.31 Webmin Webmin 0.22 Webmin Webmin 0.21 Webmin Webmin 0.8.5 Red Hat + Redhat Linux 7.0 Webmin Webmin 0.8.4 - Caldera OpenLinux Desktop 2.3 - Caldera OpenLinux Desktop 2.3 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.1 - SCO eDesktop 2.4 - SCO eDesktop 2.4 - SCO eServer 2.3.1 Webmin Webmin 0.8.3 - Caldera OpenLinux 2.4 - Caldera OpenLinux 2.4 - Caldera OpenLinux 2.3 - Caldera OpenLinux 2.3 - MandrakeSoft Corporate Server 1.0.1 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.1 Webmin Webmin 0.7 Webmin Webmin 0.6 Webmin Webmin 0.5 x Webmin Webmin 0.5 Webmin Webmin 0.4 Webmin Webmin 0.3 Webmin Webmin 0.2 Webmin Webmin 0.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0

Not Vulnerable:	Webmin Webmin 1.150

Discussion

Webmin Multiple Unspecified Vulnerabilities

Webmin is prone to multiple unspecified vulnerabilities that may allow an attacker to disclose sensitive information and carry out denial of service attacks against legitimate users of the application.

The first issue can allow a user to disclose sensitive configuration information about any module regardless of the user's privileges. The second issue can allow an attacker to send fake credentials to the application that results in locking out legitimate users of Webmin.

Webmin versions 1.140 and prior are affected by these issues.

Exploit / POC

Webmin Multiple Unspecified Vulnerabilities

No exploit is required.

Solution / Fix

Webmin Multiple Unspecified Vulnerabilities

Solution:
Webmin version 1.150 is available to address these issues.

Conectiva has released advisory CLA-2004:848 to provide Webmin updates to address this issue for Conectiva 10. Please see the referenced advisory for further details regarding obtaining and applying appropriate updates.

Gentoo has released an advisory (GLSA 200406-12) to address this issue. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:

emerge sync
emerge -pv ">=app-admin/app-admin/webmin-1.150"
emerge ">=app-admin/app-admin/webmin-1.150"

Debian GNU/Linux has released advisory DSA 526-1 addressing this issue. Please see the referenced advisory for further information.

Mandrake Linux has released advisory (MDKSA-2004:074) addressing these issues. Please see the referenced advisory for further information.

Turbolinux has released advisory 20050207 [TURBOLINUX SECURITY INFO] 07/Feb/2005 to address various issues. Please see the referenced advisory for more information.

Webmin Webmin 0.1