Webmin Pam_Login.CGI Multiple Unspecified Cross-Site Scripting Vulnerabilities

Bugtraq ID:	24381
Class:	Input Validation Error
CVE:	CVE-2007-3156
Remote:	Yes
Local:	No
Published:	Jun 08 2007 12:00AM
Updated:	Jul 09 2007 08:07PM
Credit:	The vendor disclosed these issues.
Vulnerable:	Webmin Webmin 1.340 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Gentoo Linux
Not Vulnerable:	Webmin Webmin 1.350

Webmin Pam_Login.CGI Multiple Unspecified Cross-Site Scripting Vulnerabilities

Webmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Webmin 1.340 is vulnerable; other versions may also be affected.

Webmin Pam_Login.CGI Multiple Unspecified Cross-Site Scripting Vulnerabilities

An attacker can exploit these issue by enticing an unsuspecting user to follow a malicious URI.

Webmin Pam_Login.CGI Multiple Unspecified Cross-Site Scripting Vulnerabilities

Solution:
The vendor has released Webmin 1.350 to address these issues. Please see the references for more information.


Webmin Webmin 1.340

• Webmin webmin-1.350.tar.gz
  http://prdownloads.sourceforge.net/webadmin/webmin-1.350.tar.gz

Webmin Pam_Login.CGI Multiple Unspecified Cross-Site Scripting Vulnerabilities

References:

• Changes since Webmin version 1.340 (Webmin)
  
• Webmin Homepage (Webmin)
  
• [ MDKSA-2007:135 ] - Updated webmin packages fix XSS vulnerability ([email protected])