Webmin RPC Function Privilege Escalation Vulnerability
BID:5591
Info
Webmin RPC Function Privilege Escalation Vulnerability
| Bugtraq ID: | 5591 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 28 2002 12:00AM |
| Updated: | Aug 28 2002 12:00AM |
| Credit: | This issue was reported by Noam Rathaus of SecurITeam. |
| Vulnerable: |
Webmin Webmin 0.990 Webmin Webmin 0.980 Webmin Webmin 0.970 Webmin Webmin 0.960 Webmin Webmin 0.950 Webmin Webmin 0.94 Webmin Webmin 0.93 Webmin Webmin 0.92 Webmin Webmin 0.91 Webmin Webmin 0.88 Webmin Webmin 0.85 Webmin Webmin 0.80 Webmin Webmin 0.79 Webmin Webmin 0.78 Webmin Webmin 0.77 Webmin Webmin 0.76 Webmin Webmin 0.51 Webmin Webmin 0.42 Webmin Webmin 0.41 Webmin Webmin 0.31 Webmin Webmin 0.22 Webmin Webmin 0.21 |
| Not Vulnerable: | |
Discussion
Webmin RPC Function Privilege Escalation Vulnerability
In cases where users of Webmin do not have root access on the underlying host, it may be possible to mount privilege escalation attacks on the underlying host. This normally occurs in configurations where multiple Webmin client systems have access to a centralized Webmin server.
Webmin allows commands to be executed remotely on the underlying host from other Webmin client systems via the RPC module. However, the script that provides this facility does not sufficiently check the permissions of the source of the remote commands. As a result, it is possible for remote authenticated Webmin users to abuse this facility to execute commands (as root) on the underlying host.
This may be exploited to gain root access to a system hosting the vulnerable software.
In cases where users of Webmin do not have root access on the underlying host, it may be possible to mount privilege escalation attacks on the underlying host. This normally occurs in configurations where multiple Webmin client systems have access to a centralized Webmin server.
Webmin allows commands to be executed remotely on the underlying host from other Webmin client systems via the RPC module. However, the script that provides this facility does not sufficiently check the permissions of the source of the remote commands. As a result, it is possible for remote authenticated Webmin users to abuse this facility to execute commands (as root) on the underlying host.
This may be exploited to gain root access to a system hosting the vulnerable software.
Exploit / POC
Webmin RPC Function Privilege Escalation Vulnerability
The following exploit was submitted:
The following exploit was submitted:
Solution / Fix
Webmin RPC Function Privilege Escalation Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Webmin RPC Function Privilege Escalation Vulnerability
References:
References: