Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS), read CGI program source code, list directories, and possibly execute programs.

The version of Usermin installed on the remote host is affected by an information disclosure vulnerability due to the Perl script 'miniserv.pl' failing to properly filter null characters from URLs. An attacker could exploit this to reveal the source code of CGI scripts, obtain directory listings, or launch cross-site scripting attacks against the affected application.

Webmin before 1.296 and Usermin before 1.226 does not properly handle a URL with a null ('%00') character, which allows remote attackers to conduct cross-site scripting (XSS), read CGI program source code, list directories, and possibly execute programs.

Updated packages have been patched to correct this issue.

Update :

Packages are now available for Mandriva Linux 2007.

Several vulnerabilities have been identified in webmin, a web-based administration toolkit. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CVE-2005-3912     A format string vulnerability in miniserv.pl could allow     an attacker to cause a denial of service by crashing the     application or exhausting system resources, and could     potentially allow arbitrary code execution.

  - CVE-2006-3392     Improper input sanitization in miniserv.pl could allow     an attacker to read arbitrary files on the webmin host     by providing a specially crafted URL path to the     miniserv http server.

  - CVE-2006-4542     Improper handling of null characters in URLs in     miniserv.pl could allow an attacker to conduct     cross-site scripting attacks, read CGI program source     code, list local directories, and potentially execute     arbitrary code.

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc.

The version of Webmin installed on the remote host is affected by an information disclosure vulnerability due to the Perl script 'miniserv.pl' failing to properly filter null characters from URLs. An attacker could exploit this to reveal the source code of CGI scripts, obtain directory listings, or launch cross-site scripting attacks against the affected application.

ID	Name	Product	Family	Type	Severity
77705	Usermin Null Byte Filtering Information Disclosure	Nessus	CGI abuses	Remote	medium
24556	Mandrake Linux Security Advisory : webmin (MDKSA-2006:170-1)	Nessus	Mandriva Local Security Checks	Local	medium
22908	Debian DSA-1199-1 : webmin - multiple vulnerabilities	Nessus	Debian Local Security Checks	Local	high
22300	Webmin Null Byte Filtering Information Disclosure	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2006-4542

medium

Tenable Plugins

medium

medium

high

medium