Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
91
security advisorygentoosoftware updateGentoo: GLSA-200707-05 Low Severity: Webmin, Usermin XSS Threat
Webmin and Usermin are vulnerable to cross-site scripting vulnerabilities (XSS).. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200707-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: Webmin, Usermin: Cross-site scripting vulnerabilities Date: July 05, 2007 Bugs: #181385 ID: 200707-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Webmin and Usermin are vulnerable to cross-site scripting vulnerabilities (XSS). Background ========= Webmin is a web-based administrative interface for Unix-like systems. Usermin is a simplified version of Webmin designed for use by normal users rather than system administrators. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-admin/webmin < 1.350 > = 1.350 2 app-admin/usermin < 1.280 > = 1.280 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== The pam_login.cgi file does not properly sanitize user input before sending it back as output to the user. Impact ===== An unauthenticated attacker could entice a user to browse a specially crafted URL, allowing for the execution of script code in the context of the user's browser and for the theft of browser credentials. This may permit the attacker to login to Webmin or Usermin with the user's permissions. Workaround ========= There is noknown workaround at this time. Resolution ========= All Webmin users should update to the latest stable version: # emerge --sync # emerge --ask --verbose --oneshot "> =app-admin/webmin-1.350" All Usermin users should update to the latest stable version: # emerge --sync # emerge --ask --verbose --oneshot "> =app-admin/usermin-1.280" References ========= [ 1 ] CVE-2007-3156 https://www.cve.org/CVERecord?id=CVE-2007-3156 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200707-05 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Jul 06, 2007
•Low
Gentoo
87
security advisorycriticalDebianDebian Sarge DSA 1177-1 Critical: Usermin DoS Threat Mitigated
Updated package.. - --------------------------------------------------------------------------Debian Security Advisory DSA 1177-1
Sep 15, 2006
•Critical
Debian
91
security advisoryhigh severitygentooGentoo: GLSA-200512-02 High: Webmin, Usermin Format String Exploit
Webmin and Usermin are vulnerable to a format string vulnerability which may lead to the execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200512-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Webmin, Usermin: Format string vulnerability Date: December 07, 2005 Bugs: #113888 ID: 200512-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Webmin and Usermin are vulnerable to a format string vulnerability which may lead to the execution of arbitrary code. Background ========= Webmin is a web-based interface for Unix-like systems. Usermin is a simplified version of Webmin designed for use by normal users rather than system administrators. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-admin/webmin < 1.250 > = 1.250 2 app-admin/usermin < 1.180 > = 1.180 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== Jack Louis discovered that the Webmin and Usermin "miniserv.pl" web server component is vulnerable to a Perl format string vulnerability. Login with the supplied username is logged via the Perl "syslog" facility in an unsafe manner. Impact ===== A remote attacker can trigger this vulnerability via a specially crafted username containing format string data. This can be exploited to consumea large amount of CPU and memory resources on a vulnerable system, and possibly to execute arbitrary code of the attacker's choice with the permissions of the user running Webmin. Workaround ========= There is no known workaround at this time. Resolution ========= All Webmin users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-admin/webmin-1.250" All Usermin users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-admin/usermin-1.180" References ========= [ 1 ] CVE-2005-3912 [ 2 ] Dyad Security Advisory Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200512-02 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Dec 07, 2005
Gentoo
91
security advisorygentooremote code executionGentoo: GLSA 200509-17 High: Webmin and Usermin Remote Access Risk
If Webmin or Usermin is configured to use full PAM conversations, it is vulnerable to the remote execution of arbitrary code with root privileges. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200509-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Webmin, Usermin: Remote code execution through PAM authentication Date: September 24, 2005 Bugs: #106705 ID: 200509-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= If Webmin or Usermin is configured to use full PAM conversations, it is vulnerable to the remote execution of arbitrary code with root privileges. Background ========= Webmin and Usermin are web-based system administration consoles. Webmin allows an administrator to easily configure servers and other features. Usermin allows users to configure their own accounts, execute commands, and read e-mails. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-admin/webmin < 1.230 > = 1.230 2 app-admin/usermin < 1.160 > = 1.160 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== Keigo Yamazaki discovered that the miniserv.pl webserver, used in both Webmin and Usermin, does not properly validate authentication credentials before sending them to the PAM (Pluggable Authentication Modules)authentication process. The default configuration shipped with Gentoo does not enable the "full PAM conversations" option and is therefore unaffected by this flaw. Impact ===== A remote attacker could bypass the authentication process and run any command as the root user on the target server. Workaround ========= Do not enable "full PAM conversations" in the Authentication options of Webmin and Usermin. Resolution ========= All Webmin users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-admin/webmin-1.230" All Usermin users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-admin/usermin-1.160" References ========= [ 1 ] CAN-2005-3042 https://www.cve.org/CVERecord?id=CVE-CAN-2005-3042 [ 2 ] Original Advisory Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200509-17 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 24, 2005
Gentoo
91
security advisorygentooremote code executionGentoo: GLSA-200409-15 Normal: Usermin Multiple Risks and Shellcode Attack
A vulnerability in the webmail function of Usermin could be used by an attacker to execute shell code via a specially-crafted e-mail. A bug in the installation script of Webmin and Usermin also allows a local user to execute a symlink attack at installation time. [More...]. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200409-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Webmin, Usermin: Multiple vulnerabilities in Usermin Date: September 12, 2004 Bugs: #63167 ID: 200409-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability in the webmail function of Usermin could be used by an attacker to execute shell code via a specially-crafted e-mail. A bug in the installation script of Webmin and Usermin also allows a local user to execute a symlink attack at installation time. Background ========= Webmin and Usermin are web-based system administration consoles. Webmin allows an administrator to easily configure servers and other features. Usermin allows users to configure their own accounts, execute commands, and read e-mail. The Usermin functionality, including webmail, is also included in Webmin. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-admin/usermin < 1.090 > = 1.090 2 app-admin/webmin < 1.160 > = 1.160 ------------------------------------------------------------------- 2 affected packages on all of theirsupported architectures. ------------------------------------------------------------------- Description ========== There is an input validation bug in the webmail feature of Usermin. Additionally, the Webmin and Usermin installation scripts write to /tmp/.webmin without properly checking if it exists first. Impact ===== The first vulnerability allows a remote attacker to inject arbitrary shell code in a specially-crafted e-mail. This could lead to remote code execution with the privileges of the user running Webmin or Usermin. The second could allow local users who know Webmin or Usermin is going to be installed to have arbitrary files be overwritten by creating a symlink by the name /tmp/.webmin that points to some target file, e.g. /etc/passwd. Workaround ========= There is no known workaround at this time. Resolution ========= All Usermin users should upgrade to the latest version: # emerge sync # emerge -pv "> =app-admin/usermin-1.090" # emerge "> =app-admin/usermin-1.090" All Webmin users should upgrade to the latest version: # emerge sync # emerge -pv "> =app-admin/webmin-1.160" # emerge "> =app-admin/webmin-1.160" References ========= [ 1 ] Secunia Advisory SA12488 https://www.flexera.com/products/security/software-vulnerability-research/secunia-research [ 2 ] Usermin Changelog https://webmin.com/tags/usermin-changelog/ Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200409-15 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 12, 2004
Gentoo
91
security advisoryunauthorized accessGentooGentoo: 200302-14 Critical Unauthorized Access Risk in Usermin
Due to a remotely exploitable security hole being discovered thateffects all previous Webmin releases, version 1.070 is now availablefor download.. - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200302-14 - --------------------------------------------------------------------- PACKAGE : usermin SUMMARY : unauthorized access DATE : 2003-02-24 10:10 UTC EXPLOIT : remote VERSIONS AFFECTED : From announcement: "Due to a remotely exploitable security hole being discovered that effects all previous Webmin releases, version 1.070 is now available for download from Webmin and mirror sites. This problem was reported by Cintia M. Imanishi, but fortunately there have been no known malicious exploits of it yet. However, all usersshould upgrade to 1.070 as soon as possible." "Also available is Usermin 1.000 which fixes the exact same security hole. It includes the same File Manager features, as well as support for IMAP folders and an IMAP inbox in the Read Mail module." Read the full announcement at: http://marc.theaimsgroup.com/?l=webmin-announce&m=104587858408101&w=2 SOLUTION It is recommended that all Gentoo Linux users who are running app-admin/usermin upgrade to usermin-1.000 as follows: emerge sync emerge -u usermin emerge clean - ---------------------------------------------------------------------
Feb 24, 2003
•Critical
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!