Webmin Input Validation Vulnerabilities

SANS ISC InfoSec Forums

Special Webcast: What you need to know about the crypt32.dll vulnerability. Register Now

Webmin Input Validation Vulnerabilities
If you are using Webmin within your network to administer Unix services, you should consider upgrading to the latest version 1.590 (include 2 patches) because an input validation vulnerabilities has been reported in version prior to and including 1.580. The latest version can be downloaded here or the update can be done directly in Webmin (Via menu Webmin, Webmin Configuration and Upgrade Webmin). CVE-2012-2981 - Improper Input Validation CVE-2012-2982 - Improper Neutralization of Special Elements used in a Command CVE-2012-2983 - Improper Limitation of a Pathname to a Restricted Directory [1] http://www.kb.cert.org/vuls/id/788478 [2] http://www.webmin.com/download.html ----------- Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu	Guy 451 Posts ISC Handler
Subscribe	Sep 8th 2012 7 years ago
webmin1.5.90 was released june 30 so I think this is late news?	Anonymous
Quote	Sep 8th 2012 7 years ago
Sot, updated the diary with correct link to patched version.	Guy 451 Posts ISC Handler
Quote	Sep 8th 2012 7 years ago