bugtraq - Re: Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <814b9d50607151329w157172bfr6581bf3463308abc@mail.gmail.com>
Date: Sat, 15 Jul 2006 15:29:22 -0500
From: str0ke <str0ke@...w0rm.com>
To: "José Parrella" <joseparrella@...il.com>
Cc: "Alexander Hristov" <joffer@...il.com>,
	bugtraq@...urityfocus.com,
	"Full Disclosure" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit

Jose,

It works just fine.  Tested on 7 test-bed hosts without an issue.

/str0ke

On 7/10/06, José Parrella <joseparrella@...il.com> wrote:
> On 7/9/06, Alexander Hristov <joffer@...il.com> wrote:
> > Name : Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit
> > Link : http://securitydot.net/xpl/exploits/vulnerabilities/articles/1152/exploit.html
> > Date :  2006-06-30
> > Patch : update to version 1.290
> > Advisory : http://securitydot.net/vuln/exploits/vulnerabilities/articles/17885/vuln.html
>
> Has anyone tested this? I've just tested this in Webmin 1.180 (Debian
> 3.1, package revision number 3) and didn't work (I had to explicitly
> allow the attacker IP to the miniserv.conf, which is not the default
> configuration in Debian and, I think, in Webmin's original tar.gz)
>
> Jose
>