what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2005.223

Mandriva Linux Security Advisory 2005.223
Posted Dec 3, 2005
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory - Jack Louis discovered a format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled. This can allow remote attackers to cause a denial of service (crash or memory consumption) and possibly execute arbitrary code via format string specifiers in the username parameter to the login form, which is ultimately used in a syslog call.

tags | advisory, remote, web, denial of service, arbitrary, perl
systems | linux, mandriva
advisories | CVE-2005-3912
SHA-256 | 0fee6cfab26096bc7f6d51ca1fae2f550ceb001780b74a0358d40e8fb8ca3888

Mandriva Linux Security Advisory 2005.223

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2005:223
http://www.mandriva.com/security/
_______________________________________________________________________

Package : webmin
Date : December 2, 2005
Affected: 10.1, 10.2, 2006.0, Corporate 2.1, Corporate 3.0
_______________________________________________________________________

Problem Description:

Jack Louis discovered a format string vulnerability in miniserv.pl
Perl web server in Webmin before 1.250 and Usermin before 1.180,
with syslog logging enabled. This can allow remote attackers to cause
a denial of service (crash or memory consumption) and possibly execute
arbitrary code via format string specifiers in the username parameter
to the login form, which is ultimately used in a syslog call.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3912
_______________________________________________________________________

Updated Packages:

Mandriva Linux 10.1:
1c75e57f72de9b9eb187d18de15d9a0b 10.1/RPMS/webmin-1.150-3.2.101mdk.noarch.rpm
fb3f30131577c5e7e799ee58264055aa 10.1/SRPMS/webmin-1.150-3.2.101mdk.src.rpm

Mandriva Linux 10.1/X86_64:
39782b6c2fe898596023ad384cd2d5ce x86_64/10.1/RPMS/webmin-1.150-3.2.101mdk.noarch.rpm
fb3f30131577c5e7e799ee58264055aa x86_64/10.1/SRPMS/webmin-1.150-3.2.101mdk.src.rpm

Mandriva Linux 10.2:
5ff784b1c60b7cc2fbc39487c22b6b78 10.2/RPMS/webmin-1.180-1.2.102mdk.noarch.rpm
060c31856652e82003997150f9403021 10.2/SRPMS/webmin-1.180-1.2.102mdk.src.rpm

Mandriva Linux 10.2/X86_64:
a268a1aa09cf68c7727aa7f0f479c8ac x86_64/10.2/RPMS/webmin-1.180-1.2.102mdk.noarch.rpm
060c31856652e82003997150f9403021 x86_64/10.2/SRPMS/webmin-1.180-1.2.102mdk.src.rpm

Mandriva Linux 2006.0:
25b784d8c69c42f5f816272f47528156 2006.0/RPMS/webmin-1.220-9.2.20060mdk.noarch.rpm
64772a0268b55e2d2650f4c43f4fe0b2 2006.0/SRPMS/webmin-1.220-9.2.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
bab0f651f140671b4bb01f65b9799de9 x86_64/2006.0/RPMS/webmin-1.220-9.2.20060mdk.noarch.rpm
64772a0268b55e2d2650f4c43f4fe0b2 x86_64/2006.0/SRPMS/webmin-1.220-9.2.20060mdk.src.rpm

Corporate Server 2.1:
303bd86b1156ea7ff6d08654fe824707 corporate/2.1/RPMS/webmin-0.990-6.6.C21mdk.noarch.rpm
0141850dc79c0ef041bd077264213dc9 corporate/2.1/SRPMS/webmin-0.990-6.6.C21mdk.src.rpm

Corporate Server 2.1/X86_64:
8bb1b1dd0afea4178626fd6d8470b730 x86_64/corporate/2.1/RPMS/webmin-0.990-6.6.C21mdk.noarch.rpm
0141850dc79c0ef041bd077264213dc9 x86_64/corporate/2.1/SRPMS/webmin-0.990-6.6.C21mdk.src.rpm

Corporate 3.0:
5826c5c5fea5793c594d4fa46cae6338 corporate/3.0/RPMS/webmin-1.121-4.5.C30mdk.noarch.rpm
d38cdd7a15e0340ca4e5aa95e8a5b5ec corporate/3.0/SRPMS/webmin-1.121-4.5.C30mdk.src.rpm

Corporate 3.0/X86_64:
abd80f852fa1c5628da3613623a1f1c1 x86_64/corporate/3.0/RPMS/webmin-1.121-4.5.C30mdk.noarch.rpm
d38cdd7a15e0340ca4e5aa95e8a5b5ec x86_64/corporate/3.0/SRPMS/webmin-1.121-4.5.C30mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFDkKSNmqjQ0CJFipgRAv02AJ9jK/zjwWYPUmxU+eLOPHfHcknTDgCg1wxA
OjWMSwu8XOcyXiJlYfhP3eI=
=fmDq
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

February 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    16 Files
  • 2
    Feb 2nd
    19 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    2 Files
  • 7
    Feb 7th
    10 Files
  • 8
    Feb 8th
    25 Files
  • 9
    Feb 9th
    37 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    20 Files
  • 14
    Feb 14th
    25 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    6 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    35 Files
  • 20
    Feb 20th
    25 Files
  • 21
    Feb 21st
    18 Files
  • 22
    Feb 22nd
    15 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    10 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close