CVE-2004-0559 The maketemp.pl script in Usermin 1.070 and 1.080 allows local users to overwrite arbitrary files at install time via a symlink attack on the /tmp/.usermin directory.
LowCVSS 2.1
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The maketemp.pl script in Usermin 1.070 and 1.080 allows local users to overwrite arbitrary files at install time via a symlink attack on the /tmp/.usermin directory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| usermin | = 1.000 | No fix listed |
| usermin | = 1.010 | No fix listed |
| usermin | = 1.020 | No fix listed |
| usermin | = 1.030 | No fix listed |
| usermin | = 1.040 | No fix listed |
| usermin | = 1.051 | No fix listed |
| usermin | = 1.060 | No fix listed |
| usermin | = 1.070 | No fix listed |
| usermin | = 1.080 | No fix listed |
| webmin | = 1.0.00 | No fix listed |
| webmin | = 1.0.20 | No fix listed |
| webmin | = 1.0.50 | No fix listed |
| webmin | = 1.0.60 | No fix listed |
| webmin | = 1.0.70 | No fix listed |
| webmin | = 1.0.80 | No fix listed |
| webmin | = 1.0.90 | No fix listed |
| webmin | = 1.1.00 | No fix listed |
| webmin | = 1.1.10 | No fix listed |
| webmin | = 1.1.21 | No fix listed |
| webmin | = 1.1.30 | No fix listed |
| webmin | = 1.1.40 | No fix listed |
| webmin | = 1.1.50 | No fix listed |
| mandrakesoft mandrake linux | = 9.2 | No fix listed |
| mandrakesoft mandrake linux | = 10.0 | No fix listed |
| mandrakesoft mandrake linux corporate server | = 2.1 | No fix listed |
References
- 12488 patch third-party-advisory vendor-advisory
- GLSA-200409-15 patch vendor-advisory
- 11153 patch vdb-entry vendor-advisory
- www.webmin.com
- usermin-installation-unspecified(17299) vdb-entry