Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service (crash or memory consumption) and possibly execute arbitrary code via format string specifiers in the username parameter to the login form, which is ultimately used in a syslog call. NOTE: the code execution might be associated with an issue in Perl.

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.250. It is, therefore, affected by a remote code execution vulnerability if syslog logging is enabled.

Several vulnerabilities have been identified in webmin, a web-based administration toolkit. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CVE-2005-3912     A format string vulnerability in miniserv.pl could allow     an attacker to cause a denial of service by crashing the     application or exhausting system resources, and could     potentially allow arbitrary code execution.

  - CVE-2006-3392     Improper input sanitization in miniserv.pl could allow     an attacker to read arbitrary files on the webmin host     by providing a specially crafted URL path to the     miniserv http server.

  - CVE-2006-4542     Improper handling of null characters in URLs in     miniserv.pl could allow an attacker to conduct     cross-site scripting attacks, read CGI program source     code, list local directories, and potentially execute     arbitrary code.

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc.

The Perl Development page reports :

Dyad Security recently released a security advisory explaining how in certain cases, a carefully crafted format string passed to sprintf can cause a buffer overflow. This buffer overflow can then be used by an attacker to execute code on the machine. This was discovered in the context of a design problem with the Webmin administration package that allowed a malicious user to pass unchecked data into sprintf.

Jack Louis discovered a format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled. This can allow remote attackers to cause a denial of service (crash or memory consumption) and possibly execute arbitrary code via format string specifiers in the username parameter to the login form, which is ultimately used in a syslog call.

The version of Webmin installed on the remote host contains a format string flaw when logging failed authentication attempts. Using specially crafted values for the 'username' parameter of the 'session_login.cgi', an attacker could exploit the flaw to crash the affected server or to potentially execute arbitrary code on the affected host under the privileges of the userid in which the Perl script 'miniserv.pl' runs. The default is the root user.

The remote host is affected by the vulnerability described in GLSA-200512-02 (Webmin, Usermin: Format string vulnerability)

    Jack Louis discovered that the Webmin and Usermin 'miniserv.pl'     web server component is vulnerable to a Perl format string     vulnerability. Login with the supplied username is logged via the Perl     'syslog' facility in an unsafe manner.
  Impact :

    A remote attacker can trigger this vulnerability via a specially     crafted username containing format string data. This can be exploited     to consume a large amount of CPU and memory resources on a vulnerable     system, and possibly to execute arbitrary code of the attacker's choice     with the permissions of the user running Webmin.
  Workaround :

    There is no known workaround at this time.

Fixes security vulnerabilites: CVE-2005-3962:
http://marc.theaimsgroup.com/?l=full-disclosure&m=113342788118630&w=2 CVE-2005-3912:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3912 CVE-2005-0452:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0452 CVE-2004-0976:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0976

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixed CVE-2005-3962 / CVE-2005-3912:
http://marc.theaimsgroup.com/?l=full-disclosure&m=113342788118630&w=2 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3912 backported upstream patch #26240

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
108549	Webmin < 1.250 miniserv.pl Remote Code Execution	Nessus	CGI abuses	high
22908	Debian DSA-1199-1 : webmin - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
21504	FreeBSD : perl, webmin, usermin -- perl format string integer wrap vulnerability (bb33981a-7ac6-11da-bf72-00123f589060)	Nessus	FreeBSD Local Security Checks	high
20454	Mandrake Linux Security Advisory : webmin (MDKSA-2005:223)	Nessus	Mandriva Local Security Checks	high
20343	Webmin 'miniserv.pl' 'username' Parameter Format String	Nessus	CGI abuses	high
20281	GLSA-200512-02 : Webmin, Usermin: Format string vulnerability	Nessus	Gentoo Local Security Checks	high
20258	Fedora Core 3 : perl-5.8.5-18.FC3 (2005-1116)	Nessus	Fedora Local Security Checks	high
20257	Fedora Core 4 : perl-5.8.6-18 (2005-1113)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2005-3912

critical

Tenable Plugins

high

high

high

high

high

high

high

high