SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com





Category:   Application (Generic)  >   Webmin Vendors:   Cameron, Jamie
(Caldera Issues Fix) Webmin System Administration Tool May Allow Remote Users to Obtain the Webmin Password
SecurityTracker Alert ID:  1001916
SecurityTracker URL:  http://securitytracker.com/id/1001916
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jul 3 2001
Impact:   Disclosure of authentication information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 0.84 is vulnerable; earlier versions may be vulnerable; 0.85 appears to be not vulnerable due to an authentication design change
Description:   It is reported that Webmin, a web-based UNIX/Linux system administration tool, contains a vulnerability that allows remote users to obtain the Webmin username and password.

Webmin reportedly leaves the HTTP_AUTHORIZATION environment variable set. A remote user can decode the contents of this variable using base64 decoder to obtain the login name and password for Webmin. The product also reportedly leaves the SERVER_PORT environment variable set, allowing remote users to easily locate the Webmin daemon.

Apparently, Webmin version 0.85 doesn't contain the same vulnerability because it does not use the same method of authentication.
Impact:   A remote user can obtain the Webmin user name and password.
Solution:   The vendor has released a fix. See the Source Message for the vendor's advisory containing directions on how to obtain the appropriate fix.
Vendor URL:  www.webmin.com/webmin/ (Links to External Site)
Cause:   Access control error, Authentication error
Underlying OS:   Linux (Caldera/SCO)

Message History:   This archive entry is a follow-up to the message listed below.
May 29 2001 Webmin System Administration Tool May Allow Remote Users to Obtain the Webmin Password


 Source Message Contents
Date:  Tue, 3 Jul 2001 10:45:35 -0600
Subject:  Security Update:[CSSA-2001-019.1] Linux - Webmin root account leak


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________
		   Caldera International, Inc.  Security Advisory

Subject:		Linux - webmin root account leak
Advisory number: 	CSSA-2001-019.1
Issue date: 		2001 May, 29
Last change:		2001 July, 2
Cross reference:
______________________________________________________________________________


1. Problem Description

   When starting system daemons from the webmin webfrontend, webmin
   does not clear its environment variables. Since these variables
   contain the authorization of the administrator, any daemon gets
   these variables.

   A simple attack would be to write a CGI scripts which just dumps
   all environment variables and wait for the administrator to restart
   apache using webmin.

   There is also a environment variable leakage in cron script creation,
   and a file viewing vulnerability, which makes an upgrade necessary.

   This additional CSSA releases fixed packages for the OpenLinux
   3.1 series of products.


2. Vulnerable Versions

   System                       Package
   -----------------------------------------------------------
   OpenLinux 2.3		not vulnerable
   			

   OpenLinux eServer 2.3.1      All packages previous to
   and OpenLinux eBuilder  	webmin-0.749-7

   OpenLinux eDesktop 2.4       All packages previous to
   				webmin-0.78-11

   OpenLinux 3.1 Server         All packages previous to
                                webmin-0.87-2      

   OpenLinux 3.1 Workstation    All packages previous to
                                webmin-0.87-2


3. Solution

   Workaround

      none

   The proper solution is to upgrade to the latest packages.

4. OpenLinux 2.3

   not vulnerable

5. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0

   5.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.caldera.com/pub/updates/eServer/2.3/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.caldera.com/pub/updates/eServer/2.3/current/SRPMS

   5.2 Verification

       8b978c8a6a6bf56da5f3eb56a2768e6b  RPMS/webmin-0.749-7.i386.rpm
       dad6505cde59262187828d9d2b6fe0e7  SRPMS/webmin-0.749-7.src.rpm

   5.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

	  /etc/rc.d/init.d/webmin stop
          rpm -Fvh webmin*i386.rpm
	  /etc/rc.d/init.d/webmin start

6. OpenLinux eDesktop 2.4

   6.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.caldera.com/pub/updates/eDesktop/2.4/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.caldera.com/pub/updates/eDesktop/2.4/current/SRPMS

   6.2 Verification

       cd03a53b35407547b5f4b339fcb60fda  RPMS/webmin-0.78-11.i386.rpm
       13d2b8d05eb94f7b501c231e33b06e8d  SRPMS/webmin-0.78-11.src.rpm

   6.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

	   /etc/rc.d/init.d/webmin stop
           rpm -Fvh webmin*i386.rpm
	   /etc/rc.d/init.d/webmin start

7. OpenLinux 3.1 Server

   7.1 Location of Fixed Packages

   The upgrade packages can be found on Caldera's FTP site at:

   ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS/

   The corresponding source code package can be found at:

   ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

   7.2 Verification

       10e9f27eb7e61d9d89880d8136500264  RPMS/webmin-0.87-2.i386.rpm
       5d99e6b87e9c3d58cca778ecd25a5a03  SRPMS/webmin-0.87-2.src.rpm

   7.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

	   /etc/rc.d/init.d/webmin stop
           rpm -Fvh webmin*i386.rpm
	   /etc/rc.d/init.d/webmin start

       or start kcupdate, the Caldera OpenLinux Update Manager.

8. OpenLinux 3.1 Workstation

   8.1 Location of Fixed Packages

   The upgrade packages can be found on Caldera's FTP site at:

   ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS/

   The corresponding source code package can be found at:

   ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

   8.2 Verification

       10e9f27eb7e61d9d89880d8136500264  RPMS/webmin-0.87-2.i386.rpm
       5d99e6b87e9c3d58cca778ecd25a5a03  SRPMS/webmin-0.87-2.src.rpm

   8.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

       	    /etc/rc.d/init.d/webmin stop
	    rpm -Fvh webmin*i386.rpm
	    /etc/rc.d/init.d/webmin start

       or start kcupdate, the Caldera OpenLinux Update Manager.

9. References

   This and other Caldera security resources are located at:

   http://www.caldera.com/support/security/index.html

   This security fix closes Caldera's internal Problem Report 10039.

10.Disclaimer

   Caldera International, Inc. is not responsible for the misuse of
   any of the information we provide on this website and/or through our
   security advisories. Our advisories are a service to our customers
   intended to promote secure installation and use of Caldera International
   products.

11.Acknowledgements:

   Caldera International wants to thank J. Nick Koston for reporting
   the problem and Jamie Cameron for providing a timely fix.
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE7QHpk18sy83A/qfwRAjLzAKCwnp7VcgLoj9Kju6kuGhK48oMnBwCgvFxj
7EbXIznf+7q7/rPkdKErmF4=
=ipv1
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: announce-unsubscribe@lists.caldera.com
For additional commands, e-mail: announce-help@lists.caldera.com


Go to the Top of This SecurityTracker Archive Page



Home   |    View Topics   |    Search   |    Contact Us

Copyright 2013, SecurityGlobal.net LLC