Webmin Multiple Input Validation Vulnerabilities
BID:55446
Info
Webmin Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 55446 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-2981 CVE-2012-2982 CVE-2012-2983 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 06 2012 12:00AM |
| Updated: | Mar 19 2014 02:14AM |
| Credit: | American Information Security Group |
| Vulnerable: |
Xerox FreeFlow Print Server (FFPS) 73.C0.41 Xerox FreeFlow Print Server (FFPS) 73.B3.61 Sun Solaris 10_x86 Sun Solaris 10_sparc MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 |
| Not Vulnerable: | |
Discussion
Webmin Multiple Input Validation Vulnerabilities
Webmin is prone to the following input-validation vulnerabilities because it fails to properly validate user-supplied data:
1. Multiple command-execution vulnerabilities
2. A directory-traversal vulnerability
An attacker can exploit these issues to retrieve arbitrary files using directory-traversal strings and execute arbitrary commands with application-level privileges.
Webmin 1.580 is vulnerable; prior versions may also be affected.
Webmin is prone to the following input-validation vulnerabilities because it fails to properly validate user-supplied data:
1. Multiple command-execution vulnerabilities
2. A directory-traversal vulnerability
An attacker can exploit these issues to retrieve arbitrary files using directory-traversal strings and execute arbitrary commands with application-level privileges.
Webmin 1.580 is vulnerable; prior versions may also be affected.
Exploit / POC
Webmin Multiple Input Validation Vulnerabilities
Attackers can use a browser to exploit these issues.
The following exploit code is available:
Attackers can use a browser to exploit these issues.
The following exploit code is available:
Solution / Fix
Webmin Multiple Input Validation Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.