Webmin 'useradmin/index.cgi' Local Privilege Escalation Vulnerability

Bugtraq ID:	47558
Class:	Input Validation Error
CVE:	CVE-2011-1937
Remote:	No
Local:	Yes
Published:	Apr 25 2011 12:00AM
Updated:	Jun 13 2011 06:40PM
Credit:	Javier Bassi
Vulnerable:	Webmin Webmin 1.550 MandrakeSoft Linux Mandrake 2010.1 x86_64 MandrakeSoft Linux Mandrake 2010.1 MandrakeSoft Linux Mandrake 2009.0 x86_64 MandrakeSoft Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0
Not Vulnerable:	Webmin Webmin 1.550

Webmin 'useradmin/index.cgi' Local Privilege Escalation Vulnerability

Webmin is prone to a local privilege-escalation vulnerability.

A local attacker may leverage this issue to execute arbitrary HTML and script code within the context of the web server.

Webmin 1.540 is vulnerable; other versions may also be affected.

Webmin 'useradmin/index.cgi' Local Privilege Escalation Vulnerability

An attacker can exploit this vulnerability using readily available command line utilities.

Webmin 'useradmin/index.cgi' Local Privilege Escalation Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Webmin 'useradmin/index.cgi' Local Privilege Escalation Vulnerability

References:

• Webmin Home Page (Webmin )
  
• XSS in Webmin 1.540 + exploit for privilege escalation (Javier Bassi )