miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges.

According to its self-reported version, the Webmin install hosted on the remote host is earlier than 1.070. It is, therefore, affected by an authentication bypass vulnerability.

miniserv.pl in the webmin package does not properly handle metacharacters, such as line feeds and carriage returns, in Base64-encoded strings used in Basic authentication. This vulnerability allows remote attackers to spoof a session ID, and thereby gain root privileges.

A vulnerability was discovered in webmin by Cintia M. Imanishi, in the miniserv.pl program, which is the core server of webmin. This vulnerability allows an attacker to spoof a session ID by including special metacharacters in the BASE64 encoding string used during the authentication process. This could allow an attacker to gain full administrative access to webmin.

MandrakeSoft encourages all users to upgrade immediately.

The remote server is running a version of Usermin which is vulnerable to Session ID spoofing. An attacker may use this flaw to log in as the 'root' user, and gain full control of the remote host.

The remote server is running a version of Webmin that is vulnerable to a Session ID spoofing attack. An attacker could use this flaw to log in as admin on this host, and gain full control of the system.

ID	Name	Product	Family	Severity
108544	Webmin < 1.070 authentication bypass	Nessus	CGI abuses	critical
15156	Debian DSA-319-1 : webmin - session ID spoofing	Nessus	Debian Local Security Checks	critical
14009	Mandrake Linux Security Advisory : webmin (MDKSA-2003:025)	Nessus	Mandriva Local Security Checks	critical
11280	Usermin 'miniserv.pl' Base-64 String Metacharacter Handling Session Spoofing	Nessus	CGI abuses	high
11279	Webmin 'miniserv.pl' Base-64 String Metacharacter Handling Session Spoofing	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2003-0101

critical

Tenable Plugins

critical

critical

critical

high

critical