drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Preisgabe von Informationen in Webmin
Name: |
Preisgabe von Informationen in Webmin |
|
ID: |
200608-11 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
So, 6. August 2006, 22:23 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3392 |
|
Applikationen: |
Webmin |
|
Originalnachricht |
--nextPart1497804.MihFNPFhh8 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Disposition: inline
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200608-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal Title: Webmin, Usermin: File Disclosure Date: August 06, 2006 Bugs: #138552 ID: 200608-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
Webmin and Usermin are vulnerable to an arbitrary file disclosure through a specially crafted URL.
Background ==========
Webmin is a web-based interface for Unix-like systems. Usermin is a simplified version of Webmin designed for use by normal users rather than system administrators.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-admin/webmin < 1.290 >= 1.290 2 app-admin/usermin < 1.220 >= 1.220 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. -------------------------------------------------------------------
Description ===========
A vulnerability in both Webmin and Usermin has been discovered by Kenny Chen, wherein simplify_path is called before the HTML is decoded.
Impact ======
A non-authenticated user can read any file on the server using a specially crafted URL.
Workaround ==========
For a temporary workaround, IP Access Control can be setup on Webmin and Usermin.
Resolution ==========
All Webmin users should update to the latest stable version:
# emerge --sync # emerge --ask --verbose --oneshot ">=app-admin/webmin-1.290"
All Usermin users should update to the latest stable version:
# emerge --sync # emerge --ask --verbose --oneshot ">=app-admin/usermin-1.220"
References ==========
[ 1 ] CVE-2006-3392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3392
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200608-11.xml
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.
License =======
Copyright 2006 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--nextPart1497804.MihFNPFhh8 Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQBE1kyPzKC5hMHO6rkRAjctAJ4q7kABqz2gzcQ44V+KMhFGVd+ipQCfc3Ii K7FDflzDBU239BS67MUfqls= =A8lu -----END PGP SIGNATURE-----
--nextPart1497804.MihFNPFhh8-- -- gentoo-announce@gentoo.org mailing list
|
|
|
|