Unknown vulnerability in Webmin 1.140 allows remote attackers to bypass access control rules and gain read access to configuration information for a module.

According to its self-reported version, the Webmin install hosted on the remote host is 1.140. It is, therefore, affected by multiple vulnerabilities.

Two vulnerabilities were discovered in webmin :

 CAN-2004-0582: Unknown vulnerability in Webmin 1.140 allows remote  attackers to bypass access control rules and gain read access to  configuration information for a module.

 CAN-2004-0583: The account lockout functionality in (1) Webmin 1.140  and (2) Usermin 1.070 does not parse certain character strings, which  allows remote attackers to conduct a brute-force attack to guess user  IDs and passwords.

The remote host is affected by the vulnerability described in GLSA-200406-12 (Webmin: Multiple vulnerabilities)

    Webmin contains two security vulnerabilities. One allows any user to     view the configuration of any module and the other could allow an     attacker to lock out a valid user by sending an invalid username and     password.
  Impact :

    An authenticated user could use these vulnerabilities to view the     configuration of any module thus potentially obtaining important     knowledge about configuration settings. Furthermore, an attacker could     lock out legitimate users by sending invalid login information.
  Workaround :

    There is no known workaround at this time.

Unknown vulnerability in Webmin 1.140 allows remote attackers to bypass access control rules and gain read access to configuration information for a module. (CVE-2004-0582)

The account lockout functionality in Webmin 1.140 does not parse certain character strings, which allows remote attackers to conduct a brute-force attack to guess user IDs and passwords. (CVE-2004-0583)

The updated packages are patched to correct the problem.

ID	Name	Product	Family	Severity
108545	Webmin 1.140 Multiple Vulnerabilities	Nessus	CGI abuses	medium
15363	Debian DSA-526-1 : webmin - several vulnerabilities	Nessus	Debian Local Security Checks	medium
14523	GLSA-200406-12 : Webmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
14172	Mandrake Linux Security Advisory : webmin (MDKSA-2004:074)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2004-0582

high

Tenable Plugins

medium

medium

medium

medium