Webmin, Usermin: File Disclosure — GLSA 200608-11

Webmin and Usermin are vulnerable to an arbitrary file disclosure through a specially crafted URL.

Affected packages

Package	app-admin/webmin on all architectures
Affected versions	< 1.290
Unaffected versions	>= 1.290

Package	app-admin/usermin on all architectures
Affected versions	< 1.220
Unaffected versions	>= 1.220

Background

Webmin is a web-based interface for Unix-like systems. Usermin is a simplified version of Webmin designed for use by normal users rather than system administrators.

Description

A vulnerability in both Webmin and Usermin has been discovered by Kenny Chen, wherein simplify_path is called before the HTML is decoded.

Impact

A non-authenticated user can read any file on the server using a specially crafted URL.

Workaround

For a temporary workaround, IP Access Control can be setup on Webmin and Usermin.

Resolution

All Webmin users should update to the latest stable version:

 # emerge --sync
 # emerge --ask --verbose --oneshot ">=app-admin/webmin-1.290"

All Usermin users should update to the latest stable version:

 # emerge --sync
 # emerge --ask --verbose --oneshot ">=app-admin/usermin-1.220"

References

CVE-2006-3392

Release date
August 06, 2006

Latest revision
August 06, 2006: 01

Severity
normal

Exploitable
remote

Bugzilla entries

138552