CVE-2005-3042 miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacte...
HighCVSS 7.5
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters (line feed or carriage return).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| usermin | = 1.150 | No fix listed |
| webmin | = 1.2.20 | No fix listed |
References
- 20050921 [SNS Advisory No.83] Webmin/Usermin PAM Authentication Bypass Vulnerability mailing-list patch vendor-advisory
- JVN#40940493 third-party-advisory
- 16858 patch third-party-advisory vendor-advisory
- 17282 third-party-advisory
- 17 third-party-advisory
- GLSA-200509-17 vendor-advisory
- www.lac.co.jp patch vendor-advisory
- MDKSA-2005:176 vendor-advisory
- SUSE-SR:2005:024 vendor-advisory
- 19575 vdb-entry
- 14889 vdb-entry
- ADV-2005-1791 vdb-entry
- www.webmin.com patch
- www.webmin.com