(SNS Issues Advisory) Webmin Discloses Module Configuration Data to Remote Authenticated Users
|
|
SecurityTracker Alert ID: 1010478
|
|
SecurityTracker URL: http://securitytracker.com/id?1010478
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 11 2004
|
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Secure Net Service (LAC)
|
Version(s): 1.140 and prior versions
|
Description: Two vulnerabilities were reported in Webmin. A remote user can cause user accounts to be locked out. A remote authenticated user can view module configuration data.
The vendor reported that a remote authenticated user can view the configuration of arbitrary modules, even if the user should not
have access to the module. Secure Net Service later issued an advisory indicating that Keigo Yamazaki discovered this flaw. Their
advisory is available at:
http://www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/74_e.html
The vendor also reported
that a remote user can send an invalid username or password to lock out valid users.
|
Impact: A remote authenticated user can view the configuration of arbitrary modules on the system.
A remote user can lock out a valid user's account.
|
Solution: The vendor has issued a fixed version (1.150), available at:
http://www.webmin.com/
http://localhost/nuk
e73/modules.php?name=Reviews&rop=savecomment&uname=[xss code here]&id=8&score=9
It is also reported that a remote user can invoke
the Reviews module to inject SQL commands into the 'order' field. A demonstration exploit URL is provided:
http://localhost/nuke73/modules.php?name=Reviews&rop=Q&orde
r=[sql injection code here]
It is also reported that a remote user can determine the installation path with the following type
of URLs:
http://localhost/nuke73/modules.php?name=Reviews&rop=preview_review&title=f001&text=f002&score=9&email=f00@bar.org&reviewer=f00bar&;
http://localhost/nuke7
3/modules.php?name=Reviews&rop=Yes&title=f001&text=f002&score=9&email=f00@bar.org&reviewer=f00&score=9999
A remote user can reportedly
cause the target system to consume excessive CPU resources with the following type of URL:
http://localhost/nuke73/modules.php?name=Reviews&rop=savecomment&id=1&uname=
f00bar&score=999999999999999999999999
|
Vendor URL: www.webmin.com/changes-1.150.html (Links to External Site)
|
Cause: Access control error, State error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: snsadv@lac.co.jp (snsadv)
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 11 Jun 2004 17:24:34 +0900
From: snsadv@lac.co.jp (snsadv)
Subject: [SNS Advisory No.74] Webmin Access Control Rule Bypass Vulnerability
|
----------------------------------------------------------------------
SNS Advisory No.74
Webmin Access Control Rule Bypass Vulnerability
Problem first discovered on: Sun, 11 Apr 2004
Published on: Fri, 11 Jun 2004
----------------------------------------------------------------------
Overview:
---------
Webmin is prone to a vulnerability that allows attackers to read
module settings.
Problem Description:
--------------------
Webmin is a web-based system administration tool for Unix.
A vulnerability exists that could allow users to gain read access to
the configuration of a module used by Webmin without authentication.
Tested Versions:
----------------
Webmin Version 1.140
Solution:
---------
This problem can be eliminated by upgrading to Webmin version 1.150,
which is available at:
http://www.webmin.com/
Discovered by:
--------------
Keigo Yamazaki
Acknowledgements:
-----------------
Thanks to:
Mr. Jamie Cameron
Disclaimer:
-----------
The information contained in this advisory may be revised without prior
notice and is provided as it is. Users shall take their own risk when
taking any actions following reading this advisory. LAC Co., Ltd. shall
take no responsibility for any problems, loss or damage caused by, or by
the use of information provided here.
This advisory can be found at the following URL:
http://www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/74_e.html
------------------------------------------------------------------
Secure Net Service(SNS) Security Advisory <snsadv@lac.co.jp>
Computer Security Laboratory, LAC http://www.lac.co.jp/security/
|
|
