Test ID:	1.3.6.1.4.1.25623.1.0.53608
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 319-1 (webmin)
Summary:	The remote host is missing an update to webmin;announced via advisory DSA 319-1.
Description:	Summary: The remote host is missing an update to webmin announced via advisory DSA 319-1. Vulnerability Insight: miniserv.pl in the webmin package does not properly handle metacharacters, such as line feeds and carriage returns, in Base64-encoded strings used in Basic authentication. This vulnerability allows remote attackers to spoof a session ID, and thereby gain root privileges. For the stable distribution (woody) this problem has been fixed in version 0.94-7woody1. The old stable distribution (potato) does not contain a webmin package. For the unstable distribution (sid) this problem is fixed in version 1.070-1. We recommend that you update your webmin package. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0101 BugTraq ID: 6915 http://www.securityfocus.com/bid/6915 Bugtraq: 20030224 GLSA: usermin (200302-14) (Google Search) http://marc.info/?l=bugtraq&m=104610336226274&w=2 Bugtraq: 20030224 Webmin 1.050 - 1.060 remote exploit (Google Search) http://marc.info/?l=bugtraq&m=104610245624895&w=2 Bugtraq: 20030224 [SNS Advisory No.62] Webmin/Usermin Session ID Spoofing Vulnerability "Episode 2" (Google Search) http://marc.info/?l=bugtraq&m=104610300325629&w=2 Computer Incident Advisory Center Bulletin: N-058 http://www.ciac.org/ciac/bulletins/n-058.shtml Debian Security Information: DSA-319 (Google Search) http://www.debian.org/security/2003/dsa-319 En Garde Linux Advisory: ESA-20030225-006 http://archives.neohapsis.com/archives/linux/engarde/2003-q1/0008.html HPdes Security Advisory: HPSBUX0303-250 http://archives.neohapsis.com/archives/hp/2003-q1/0063.html http://www.mandriva.com/security/advisories?name=MDKSA-2003:025 http://www.lac.co.jp/security/english/snsadv_e/62_e.html http://www.securitytracker.com/id?1006160 http://secunia.com/advisories/8115 http://secunia.com/advisories/8163 SGI Security Advisory: 20030602-01-I ftp://patches.sgi.com/support/free/security/advisories/20030602-01-I http://www.iss.net/security_center/static/11390.php
Copyright	Copyright (C) 2008 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.