Mandrake Linux Security Advisory : webmin (MDKSA-2005:176)

high Nessus Plugin ID 20429

Synopsis

The remote Mandrake Linux host is missing a security update.

Description

Miniserv.pl in Webmin 1.220, when 'full PAM conversations' is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters (line feed or carriage return).

The updated packages have been patched to correct this issues.

Solution

Update the affected webmin package.

Plugin Details

Severity: High

ID: 20429

File Name: mandrake_MDKSA-2005-176.nasl

Version: 1.14

Type: local

Family: Mandriva Local Security Checks

Published: 1/15/2006

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:webmin, cpe:/o:mandriva:linux:2006

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 10/7/2005

Reference Information

CVE: CVE-2005-3042

MDKSA: 2005:176

Detections

Analytics