Published: 03/03/2003 Updated: 18/10/2016

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

miniserv.pl in (1) Webmin prior to 1.070 and (2) Usermin prior to 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote malicious users to spoof a session ID and gain root privileges.

Vulnerable Product	Search on Vulmon	Subscribe to Product
usermin usermin 0.6
usermin usermin 0.7
usermin usermin 0.96
usermin usermin 0.97
usermin usermin 0.4
usermin usermin 0.5
usermin usermin 0.93
usermin usermin 0.94
usermin usermin 0.95
usermin usermin 0.8
usermin usermin 0.9
usermin usermin 0.98
usermin usermin 0.99
engardelinux guardian digital webtool 1.2
usermin usermin 0.91
usermin usermin 0.92
webmin webmin 1.0.50
webmin webmin 1.0.60

miniservpl in the webmin package does not properly handle metacharacters, such as line feeds and carriage returns, in Base64-encoded strings used in Basic authentication This vulnerability allows remote attackers to spoof a session ID, and thereby gain root privileges For the stable distribution (woody) this problem has been fixed in version 09 ...

source: wwwsecurityfocuscom/bid/6915/info A vulnerability has been discovered in the 'Miniservpl' script used to invoke both Webmin and Usermin Due to insufficient sanitization of client-supplied BASE64 encoded input, it is possible to inject a Session ID into the access control list Successful exploitation of this vulnerability may a ...

NVD-CWE-Other http://www.iss.net/security_center/static/11390.php http://www.lac.co.jp/security/english/snsadv_e/62_e.html http://www.debian.org/security/2003/dsa-319 http://archives.neohapsis.com/archives/linux/engarde/2003-q1/0008.html http://archives.neohapsis.com/archives/hp/2003-q1/0063.html ftp://patches.sgi.com/support/free/security/advisories/20030602-01-I http://www.ciac.org/ciac/bulletins/n-058.shtml http://www.securityfocus.com/bid/6915 http://www.linuxsecurity.com/advisories/gentoo_advisory-2886.html http://www.mandriva.com/security/advisories?name=MDKSA-2003:025 http://secunia.com/advisories/8115 http://secunia.com/advisories/8163 http://www.securitytracker.com/id?1006160 http://marc.info/?l=webmin-announce&m=104587858408101&w=2 http://marc.info/?l=bugtraq&m=104610336226274&w=2 http://marc.info/?l=bugtraq&m=104610245624895&w=2 http://marc.info/?l=bugtraq&m=104610300325629&w=2 https://nvd.nist.gov https://www.debian.org/security/./dsa-319 https://www.exploit-db.com/exploits/22275/

CVE-2003-0101

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect