full-disclosure - Webmin miniserv.pl format string vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue Nov 29 18:27:25 2005
From: research at sec-consult.com (Bernhard Mueller)
Subject: Webmin miniserv.pl format string vulnerability

As it says on http://www.dyadsecurity.com/s_advisory.html:

PUBLISHED ADVISORIES.
Webmin
Date Found: 	September 23, 2005.
Public Release: 	November 29, 2005.
Application: 	webmin miniserv.pl, all known versions
Details: 	Webmin 0001 Advisory

UPCOMING ADVISORIES.
Perl
Description: 	Cross platform programming language.
Affected: 	To be announced.
Release Date: 	To be announced.

I guess we can expect some kind of "code execution thru perl sprintf"
advisory.

advisory@...dsecurity.com wrote:
> SUMMARY.  The webmin `miniserv.pl' web server component is vulnerable to
> a new class of exploitable (remote code) perl format string
> vulnerabilities. During the login process it is possible to trigger this
>(...)
> 
> A generic remote code execution exploit method has been developed by a
> third party that is reachable though this hole itself.
>