Webmin Usermin CVE-2014-3883 Remote Command Injection Vulnerability

Bugtraq ID:	68131
Class:	Input Validation Error
CVE:	CVE-2014-3883
Remote:	Yes
Local:	No
Published:	Jun 20 2014 12:00AM
Updated:	Jun 20 2014 12:00AM
Credit:	Keigo Yamazaki of LAC Co., Ltd
Vulnerable:	Webmin Usermin 1.180 Webmin Usermin 1.170 Webmin Usermin 1.160 Webmin Usermin 1.150 Webmin Usermin 1.140 Webmin Usermin 1.130 Webmin Usermin 1.120 Webmin Usermin 1.110 Webmin Usermin 1.0 Webmin Usermin 0.99 + Mandriva Linux Mandrake 9.0 Webmin Usermin 0.98 + HP Apache-Based Web Server 2.0.43 .00 + HP Apache-Based Web Server 1.3.27 .00 + HP Webmin-Based Admin 1.0 .01 Webmin Usermin 0.97 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 Webmin Usermin 0.96 Webmin Usermin 0.95 Webmin Usermin 0.94 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha Webmin Usermin 0.93 Webmin Usermin 0.92 Webmin Usermin 0.91 Webmin Usermin 0.9 Webmin Usermin 0.8 Webmin Usermin 0.7 Webmin Usermin 0.6 Webmin Usermin 0.5 Webmin Usermin 0.4 Webmin Usermin 1.430 Webmin Usermin 1.320 Webmin Usermin 1.300 Webmin Usermin 1.226 Webmin Usermin 1.220
Not Vulnerable:

Webmin Usermin CVE-2014-3883 Remote Command Injection Vulnerability

Attackers can exploit this issue using browser or readily available tools.

Webmin Usermin CVE-2014-3883 Remote Command Injection Vulnerability

Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.

Webmin Usermin CVE-2014-3883 Remote Command Injection Vulnerability

References:

• Webmin Home Page (Webmin )