BID:11153

Webmin / Usermin Installation Insecure Temporary File Creation Vulnerability

Info

Webmin / Usermin Installation Insecure Temporary File Creation Vulnerability

Bugtraq ID:	11153
Class:	Access Validation Error
CVE:	CVE-2004-0559
Remote:	No
Local:	Yes
Published:	Sep 10 2004 12:00AM
Updated:	Jul 12 2009 07:06AM
Credit:	The vendor announced this vulnerability.
Vulnerable:	Webmin Webmin 1.150 Webmin Webmin 1.140 Webmin Webmin 1.130 Webmin Webmin 1.121 Webmin Webmin 1.110 Webmin Webmin 1.100 Webmin Webmin 1.0 90 Webmin Webmin 1.0 80 Webmin Webmin 1.0 70 + HP Apache-Based Web Server 1.3.27 .01 + HP Apache-Based Web Server 1.3.27 .01 + HP Webmin-Based Admin 1.0.1 .01 + HP Webmin-Based Admin 1.0.1 .01 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 8.0 Webmin Webmin 1.0 60 Webmin Webmin 1.0 50 Webmin Webmin 1.0 20 Webmin Webmin 1.0 00 Usermin Usermin 1.0 80 Usermin Usermin 1.0 70 Usermin Usermin 1.0 60 Usermin Usermin 1.0 51 Usermin Usermin 1.0 40 Usermin Usermin 1.0 30 Usermin Usermin 1.0 20 Usermin Usermin 1.0 10 Usermin Usermin 1.0 00 Usermin Usermin 0.990 Usermin Usermin 0.980 Usermin Usermin 0.970 Usermin Usermin 0.960 Usermin Usermin 0.950 Usermin Usermin 0.940 Usermin Usermin 0.930 Usermin Usermin 0.920 Usermin Usermin 0.910 Usermin Usermin 0.90 Usermin Usermin 0.80 Usermin Usermin 0.7 Mandriva Linux Mandrake 10.0 AMD64 Mandriva Linux Mandrake 10.0 Mandriva Linux Mandrake 9.2 amd64 Mandriva Linux Mandrake 9.2 MandrakeSoft Corporate Server 2.1 x86_64 MandrakeSoft Corporate Server 2.1

Not Vulnerable:	Webmin Webmin 1.160 Usermin Usermin 1.0 90

Discussion

Webmin / Usermin Installation Insecure Temporary File Creation Vulnerability

It is reported that Webmin and Usermin create insecure temporary files during installation. The result of this is that temporary files created by the applications may use predictable filenames.

A local attacker may possibly exploit this vulnerability to execute symbolic link file overwrite attacks.

Versions of Usermin prior to version 1.090 are reported prone to this vulnerability. Webmin 1.150 and prior versions are affected as well.

Exploit / POC

Webmin / Usermin Installation Insecure Temporary File Creation Vulnerability

No exploit is required.

Solution / Fix

Webmin / Usermin Installation Insecure Temporary File Creation Vulnerability

Solution:
It is reported that Usermin version 1.090 and Webmin 1.160 are not affected by this issue.

Gentoo has released an advisory to address these issues. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:

Usermin:
emerge sync
emerge -pv ">=app-admin/usermin-1.090"
emerge ">=app-admin/usermin-1.090"

Webmin:
emerge sync
emerge -pv ">=app-admin/webmin-1.160"
emerge ">=app-admin/webmin-1.160"

Debian has released advisory DSA 544-1 along with fixes dealing with this issue. Please see the referenced advisory for more information.

Mandrake Linux has released advisory MDKSA-2004:101 along with fixes to address this issue. Please see the referenced advisory for further information.

Turbolinux has released advisory 20050207 [TURBOLINUX SECURITY INFO] 07/Feb/2005 to address various issues. Please see the referenced advisory for more information.

Usermin Usermin 0.7