The version of Webmin installed on the remote host contains a format string flaw when logging failed authentication attempts. Using specially crafted values for the 'username' parameter of the 'session_login.cgi', an attacker could exploit the flaw to crash the affected server or to potentially execute arbitrary code on the affected host under the privileges of the userid in which the Perl script 'miniserv.pl' runs. The default is the root user.

自己報告されたバージョンによると、リモートホストでホストされているWebminインストールは1.250より前です。したがって、syslogログが有効な場合、リモートでコードが実行される脆弱性の影響を受けます。

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.250. It is, therefore, affected by a remote code execution vulnerability if syslog logging is enabled.

Jack Louis discovered a format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled. This can allow remote attackers to cause a denial of service (crash or memory consumption) and possibly execute arbitrary code via format string specifiers in the username parameter to the login form, which is ultimately used in a syslog call.

根据其自我报告的版本，远程主机上托管的 Webmin 安装版本低于 1.250。如果启用 syslog 日志记录，因而会受到远程代码执行漏洞的影响。

根據其自我報告的版本，遠端主機上安裝的 Webmin 比 1.250 舊。因此，如果已啟用 syslog 記錄，則會受到一個遠端程式碼執行弱點影響。

當登入驗證嘗試失敗時，遠端主機上安裝的 Webmin 版本會發生格式字串問題。攻擊者可針對「session_login.cgi」的「username」參數使用特製的值，利用此缺陷來造成受影響的伺服器當機，或可能使用執行 Perl 指令碼「miniserv.pl」的使用者 ID 權限在受影響的主機上執行任意程式碼。預設為 root 使用者。

リモートホストにインストールされているWebminのバージョンに、失敗した認証試行のロギング時の書式文字列の欠陥があります。攻撃者は、「session_login.cgi」の「username」パラメーターに特別に細工された値を使用して、この欠陥を悪用し、影響を受けるサーバーをクラッシュさせたり、Perlスクリプト「miniserv.pl」が実行されているユーザーIDの権限で、影響を受けるホストで任意のコードを実行したりする可能性があります。デフォルトはrootユーザーです。

The Perl Development page reports :

Dyad Security recently released a security advisory explaining how in certain cases, a carefully crafted format string passed to sprintf can cause a buffer overflow. This buffer overflow can then be used by an attacker to execute code on the machine. This was discovered in the context of a design problem with the Webmin administration package that allowed a malicious user to pass unchecked data into sprintf.

Fixed CVE-2005-3962 / CVE-2005-3912:
http://marc.theaimsgroup.com/?l=full-disclosure&m=113342788118630&w=2 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3912 backported upstream patch #26240

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been identified in webmin, a web-based administration toolkit. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CVE-2005-3912     A format string vulnerability in miniserv.pl could allow     an attacker to cause a denial of service by crashing the     application or exhausting system resources, and could     potentially allow arbitrary code execution.

  - CVE-2006-3392     Improper input sanitization in miniserv.pl could allow     an attacker to read arbitrary files on the webmin host     by providing a specially crafted URL path to the     miniserv http server.

  - CVE-2006-4542     Improper handling of null characters in URLs in     miniserv.pl could allow an attacker to conduct     cross-site scripting attacks, read CGI program source     code, list local directories, and potentially execute     arbitrary code.

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc.

Fixes security vulnerabilites: CVE-2005-3962:
http://marc.theaimsgroup.com/?l=full-disclosure&m=113342788118630&w=2 CVE-2005-3912:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3912 CVE-2005-0452:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0452 CVE-2004-0976:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0976

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200512-02 (Webmin, Usermin: Format string vulnerability)

    Jack Louis discovered that the Webmin and Usermin 'miniserv.pl'     web server component is vulnerable to a Perl format string     vulnerability. Login with the supplied username is logged via the Perl     'syslog' facility in an unsafe manner.
  Impact :

    A remote attacker can trigger this vulnerability via a specially     crafted username containing format string data. This can be exploited     to consume a large amount of CPU and memory resources on a vulnerable     system, and possibly to execute arbitrary code of the attacker's choice     with the permissions of the user running Webmin.
  Workaround :

    There is no known workaround at this time.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
20343	Webmin 'miniserv.pl' 'username' Parameter Format String	Nessus	CGI abuses	2005/12/26	2021/1/19	high
108549	Webmin < 1.250 miniserv.plリモートでのコード実行	Nessus	CGI abuses	2018/3/22	2019/11/8	high
108549	Webmin < 1.250 miniserv.pl Remote Code Execution	Nessus	CGI abuses	2018/3/22	2019/11/8	high
20454	Mandrake Linux Security Advisory : webmin (MDKSA-2005:223)	Nessus	Mandriva Local Security Checks	2006/1/15	2021/1/6	high
108549	Webmin < 1.250 miniserv.pl 远程代码执行	Nessus	CGI abuses	2018/3/22	2019/11/8	high
108549	Webmin < 1.250 miniserv.pl 遠端程式碼執行	Nessus	CGI abuses	2018/3/22	2019/11/8	high
20343	Webmin「miniserv.pl」「username」參數格式字串	Nessus	CGI abuses	2005/12/26	2021/1/19	high
20343	Webmin「miniserv.pl」「username」パラメーターの書式文字列	Nessus	CGI abuses	2005/12/26	2021/1/19	high
21504	FreeBSD : perl, webmin, usermin -- perl format string integer wrap vulnerability (bb33981a-7ac6-11da-bf72-00123f589060)	Nessus	FreeBSD Local Security Checks	2006/5/13	2021/1/6	high
20257	Fedora Core 4 : perl-5.8.6-18 (2005-1113)	Nessus	Fedora Local Security Checks	2005/12/7	2021/1/11	high
22908	Debian DSA-1199-1 : webmin - multiple vulnerabilities	Nessus	Debian Local Security Checks	2006/10/25	2021/1/4	high
20258	Fedora Core 3 : perl-5.8.5-18.FC3 (2005-1116)	Nessus	Fedora Local Security Checks	2005/12/7	2021/1/11	high
20281	GLSA-200512-02 : Webmin, Usermin: Format string vulnerability	Nessus	Gentoo Local Security Checks	2005/12/8	2021/1/6	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high

high

high

high

high