bugtraq - MDKSA-2005:223 - Updated webmin package fixes format string vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 02 Dec 2005 16:02:01 -0700
From: Mandriva Security Team <security@...driva.com>
To: bugtraq@...urityfocus.com
Subject: MDKSA-2005:223 - Updated webmin package fixes format string vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2005:223
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : webmin
 Date    : December 2, 2005
 Affected: 10.1, 10.2, 2006.0, Corporate 2.1, Corporate 3.0
 _______________________________________________________________________
 
 Problem Description:
 
 Jack Louis discovered a format string vulnerability in miniserv.pl 
 Perl web server in Webmin before 1.250 and Usermin before 1.180, 
 with syslog logging enabled. This can allow remote attackers to cause 
 a denial of service (crash or memory consumption) and possibly execute 
 arbitrary code via format string specifiers in the username parameter 
 to the login form, which is ultimately used in a syslog call.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3912
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 10.1:
 1c75e57f72de9b9eb187d18de15d9a0b  10.1/RPMS/webmin-1.150-3.2.101mdk.noarch.rpm
 fb3f30131577c5e7e799ee58264055aa  10.1/SRPMS/webmin-1.150-3.2.101mdk.src.rpm

 Mandriva Linux 10.1/X86_64:
 39782b6c2fe898596023ad384cd2d5ce  x86_64/10.1/RPMS/webmin-1.150-3.2.101mdk.noarch.rpm
 fb3f30131577c5e7e799ee58264055aa  x86_64/10.1/SRPMS/webmin-1.150-3.2.101mdk.src.rpm

 Mandriva Linux 10.2:
 5ff784b1c60b7cc2fbc39487c22b6b78  10.2/RPMS/webmin-1.180-1.2.102mdk.noarch.rpm
 060c31856652e82003997150f9403021  10.2/SRPMS/webmin-1.180-1.2.102mdk.src.rpm

 Mandriva Linux 10.2/X86_64:
 a268a1aa09cf68c7727aa7f0f479c8ac  x86_64/10.2/RPMS/webmin-1.180-1.2.102mdk.noarch.rpm
 060c31856652e82003997150f9403021  x86_64/10.2/SRPMS/webmin-1.180-1.2.102mdk.src.rpm

 Mandriva Linux 2006.0:
 25b784d8c69c42f5f816272f47528156  2006.0/RPMS/webmin-1.220-9.2.20060mdk.noarch.rpm
 64772a0268b55e2d2650f4c43f4fe0b2  2006.0/SRPMS/webmin-1.220-9.2.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 bab0f651f140671b4bb01f65b9799de9  x86_64/2006.0/RPMS/webmin-1.220-9.2.20060mdk.noarch.rpm
 64772a0268b55e2d2650f4c43f4fe0b2  x86_64/2006.0/SRPMS/webmin-1.220-9.2.20060mdk.src.rpm

 Corporate Server 2.1:
 303bd86b1156ea7ff6d08654fe824707  corporate/2.1/RPMS/webmin-0.990-6.6.C21mdk.noarch.rpm
 0141850dc79c0ef041bd077264213dc9  corporate/2.1/SRPMS/webmin-0.990-6.6.C21mdk.src.rpm

 Corporate Server 2.1/X86_64:
 8bb1b1dd0afea4178626fd6d8470b730  x86_64/corporate/2.1/RPMS/webmin-0.990-6.6.C21mdk.noarch.rpm
 0141850dc79c0ef041bd077264213dc9  x86_64/corporate/2.1/SRPMS/webmin-0.990-6.6.C21mdk.src.rpm

 Corporate 3.0:
 5826c5c5fea5793c594d4fa46cae6338  corporate/3.0/RPMS/webmin-1.121-4.5.C30mdk.noarch.rpm
 d38cdd7a15e0340ca4e5aa95e8a5b5ec  corporate/3.0/SRPMS/webmin-1.121-4.5.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 abd80f852fa1c5628da3613623a1f1c1  x86_64/corporate/3.0/RPMS/webmin-1.121-4.5.C30mdk.noarch.rpm
 d38cdd7a15e0340ca4e5aa95e8a5b5ec  x86_64/corporate/3.0/SRPMS/webmin-1.121-4.5.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFDkKSNmqjQ0CJFipgRAv02AJ9jK/zjwWYPUmxU+eLOPHfHcknTDgCg1wxA
OjWMSwu8XOcyXiJlYfhP3eI=
=fmDq
-----END PGP SIGNATURE-----