Webmin Remote Directory Traversal Vulnerability

Bugtraq ID:	18613
Class:	Input Validation Error
CVE:	CVE-2006-3274
Remote:	Yes
Local:	No
Published:	Jun 23 2006 12:00AM
Updated:	Feb 20 2007 08:28PM
Credit:	The disclosure of this issue has been credited to Keigo Yamazaki of Little eArth Corporation.
Vulnerable:	Webmin Webmin 1.270 Webmin Webmin 1.260 Webmin Webmin 1.250 Webmin Webmin 1.240 Webmin Webmin 1.230 Webmin Webmin 1.220 Webmin Webmin 1.210 Webmin Webmin 1.200 Webmin Webmin 1.190 Webmin Webmin 1.180 Webmin Webmin 1.170 Webmin Webmin 1.160 Webmin Webmin 1.150 Webmin Webmin 1.140 Webmin Webmin 1.130 Webmin Webmin 1.121 Webmin Webmin 1.110 Webmin Webmin 1.100 Webmin Webmin 1.0 90 Webmin Webmin 1.0 80 Webmin Webmin 1.0 70 + HP Apache-Based Web Server 1.3.27 .01 + HP Apache-Based Web Server 1.3.27 .01 + HP Webmin-Based Admin 1.0.1 .01 + HP Webmin-Based Admin 1.0.1 .01 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 8.0 Webmin Webmin 1.0 60 Webmin Webmin 1.0 50 Webmin Webmin 1.0 20 Webmin Webmin 1.0 00
Not Vulnerable:	Webmin Webmin 1.280

Webmin Remote Directory Traversal Vulnerability

It is reported that Webmin may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory. This issue is only reported to present itself in Webmin running on Windows platforms. A remote attacker may traverse outside the server root directory by using encoded '\..' character sequences.

Webmin Remote Directory Traversal Vulnerability

No exploit is required. This issue can be exploited through a web client.

Webmin Remote Directory Traversal Vulnerability

Solution:
The vendor has released Webmin version 1.280.0.

Webmin Remote Directory Traversal Vulnerability

References:

• SNS Advisory No.88 (Little eArth Corporation (LAC):)
  
• Version 1.280 (16 June 2006) (Webmin)
  
• Webmin Homepage (Webmin)