FreeBSD : perl, webmin, usermin -- perl format string integer wrap vulnerability (bb33981a-7ac6-11da-bf72-00123f589060)

High Nessus Plugin ID 21504


The remote FreeBSD host is missing one or more security-related updates.


The Perl Development page reports :

Dyad Security recently released a security advisory explaining how in certain cases, a carefully crafted format string passed to sprintf can cause a buffer overflow. This buffer overflow can then be used by an attacker to execute code on the machine. This was discovered in the context of a design problem with the Webmin administration package that allowed a malicious user to pass unchecked data into sprintf.


Update the affected packages.

See Also

Plugin Details

Severity: High

ID: 21504

File Name: freebsd_pkg_bb33981a7ac611dabf7200123f589060.nasl

Version: $Revision: 1.15 $

Type: local

Published: 2006/05/13

Modified: 2016/05/05

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:ND

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:perl, p-cpe:/a:freebsd:freebsd:usermin, p-cpe:/a:freebsd:freebsd:webmin, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2006/02/15

Vulnerability Publication Date: 2005/09/23

Exploitable With


Core Impact

Reference Information

CVE: CVE-2005-3912, CVE-2005-3962

BID: 15629