Webmin Environment Variable Information Disclosure Vulnerability

Bugtraq ID:	2795
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	May 28 2001 12:00AM
Updated:	May 28 2001 12:00AM
Credit:	Reported to bugtraq by J. Nick Koston <[email protected]> on May 26, 2001
Vulnerable:	Webmin Webmin 0.85 - Caldera OpenLinux 2.4 - Caldera OpenLinux 2.4 - Caldera OpenLinux 2.3 - Caldera OpenLinux 2.3 - MandrakeSoft Corporate Server 1.0.1 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.1 Webmin Webmin 0.80 Webmin Webmin 0.8.4 - Caldera OpenLinux Desktop 2.3 - Caldera OpenLinux Desktop 2.3 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.1 - SCO eDesktop 2.4 - SCO eDesktop 2.4 - SCO eServer 2.3.1 Webmin Webmin 0.8.3 - Caldera OpenLinux 2.4 - Caldera OpenLinux 2.4 - Caldera OpenLinux 2.3 - Caldera OpenLinux 2.3 - MandrakeSoft Corporate Server 1.0.1 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.1 Webmin Webmin 0.7 Webmin Webmin 0.6 Webmin Webmin 0.5 x
Not Vulnerable:

Webmin Environment Variable Information Disclosure Vulnerability

(courtesy J. Nick Koston <[email protected]>)
---
You can best see the effects by:

1. Kill Apache
2. Start Apache will webmin
3. Goto a <?php phpinfo() ?> page and look at the vars
---

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.