[UNIX] Webmin/Usermin Session ID Spoofing Vulnerability "Episode 2"

From: support@securiteam.com
Date: 03/09/03

  • Next message: support@securiteam.com: "[NEWS] DeleGate Pointer Array Overflow May Let Remote Users Execute Arbitrary Code" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 9 Mar 2003 20:05:39 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    In the US?

    Contact Beyond Security at our new California office
    housewarming rates on automated network vulnerability
    scanning. We also welcome ISPs and other resellers!

    Please contact us at: 323-882-8286 or ussales@beyondsecurity.com
    - - - - - - - - -

      Webmin/Usermin Session ID Spoofing Vulnerability "Episode 2"
    ------------------------------------------------------------------------

    SUMMARY

    Webmin is a web-based system administration tool for UNIX. Usermin is a
    web interface that allows all users on a UNIX system to easily receive
    mails and to perform SSH and mail forwarding configuration. A
    vulnerability that could result in a session ID spoofing exists in
    miniserv.pl, which is a web server program that gets both Webmin and
    Usermin to run.

    DETAILS

    Vulnerable systems:
     * Webmin Version: 1.060
     * Usermin Version: 0.990

    Miniserv.pl is a web server program that gets both Webmin and Usermin to
    run. Miniserv.pl carries out named pipe communication between the parent
    and the child process during for example, the creation and confirmation of
    a session ID (session used for access control via the Web) and during the
    password timeout process.

    Miniserv.pl does not check whether metacharacters, such as line feed or
    carriage return, are included with BASE64 encoded strings during the BASIC
    authentication process. As a result, any user can login as an
    administrative user "admin" and spoof a session ID by using the pipe.

    Exploitation therefore, could make it possible for attackers to bypass
    authentication and execute arbitrary command as root.

    Preconditions for the exploit:
    Webmin:
     * Webmin -> Configuration -> Authentication and "Enable password
    timeouts" is ON
     * A valid Webmin username is known

    Usermin:
     * "Enable password timeouts" is ON
     * A valid Webmin username is known

    Solution:
    This problem can be eliminated by upgrading to Webmin version 1.070 and
    Usermin version 1.000 available at: <http://www.webmin.com/>
    http://www.webmin.com/

    ADDITIONAL INFORMATION

    The original advisory can be found at:
     <http://www.lac.co.jp/security/english/snsadv_e/62_e.html>
    http://www.lac.co.jp/security/english/snsadv_e/62_e.html

    The information has been provided by <mailto:snsadv@lac.co.jp> SNS
    Advisories.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: support@securiteam.com: "[NEWS] DeleGate Pointer Array Overflow May Let Remote Users Execute Arbitrary Code"

    Relevant Pages