[Please upgrade Webmin on all platforms -- Raju]
This is an RFC 1153 digest.
(1 message)
----------------------------------------------------------------------
Message-Id: <[EMAIL PROTECTED]>
From: [EMAIL PROTECTED] (snsadv)
To: [EMAIL PROTECTED]
Subject: [SNS Advisory No.75] Webmin/Usermin Account Lockout Bypass Vulnerability
Date: Fri, 11 Jun 2004 17:25:13 +0900
----------------------------------------------------------------------
SNS Advisory No.75
Webmin/Usermin Account Lockout Bypass Vulnerability
Problem first discovered on: Sun, 11 Apr 2004
Published on: Fri, 11 Jun 2004
----------------------------------------------------------------------
Overview:
---------
A vulnerability that could result in account lockout bypassing exists
in both Webmin and Usermin.
Problem Description:
--------------------
Webmin is a web-based system administration tool for Unix. Usermin
is a web interface that allows all users on a Unix system to easily
receive mails and to perform SSH and mail forwarding configuration.
Both Webmin and Usermin ship with an account lockout functionality,
which fails to parse certain character strings. By bypassing this
functionality, attackers can attempt to guess IDs and passwords
continuously, prevent legitimate users from logging on, etc.
Tested Versions:
----------------
Webmin Version 1.140
Usermin Version 1.070
Solution:
---------
This problem can be eliminated by upgrading to Webmin version 1.150
and to Usermin version 1.080, which are available at:
http://www.webmin.com/
Discovered by:
--------------
Keigo Yamazaki
Acknowledgements:
-----------------
Mr. Jamie Cameron
Disclaimer:
-----------
The information contained in this advisory may be revised without prior
notice and is provided as it is. Users shall take their own risk when
taking any actions following reading this advisory. LAC Co., Ltd. shall
take no responsibility for any problems, loss or damage caused by, or by
the use of information provided here.
This advisory can be found at the following URL:
http://www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/75_e.html
------------------------------------------------------------------
Secure Net Service(SNS) Security Advisory <[EMAIL PROTECTED]>
Computer Security Laboratory, LAC http://www.lac.co.jp/security/
------------------------------
End of this Digest
******************
--
Raj Mathur [EMAIL PROTECTED] http://kandalaya.org/
GPG: 78D4 FC67 367F 40E2 0DD5 0FEF C968 D0EF CC68 D17F
It is the mind that moves
-------------------------------------------------------
This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
_______________________________________________
linux-india-help mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/linux-india-help
