full-disclosure - Re: Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <814b9d50607151329w157172bfr6581bf3463308abc@mail.gmail.com>
Date: Sat Jul 15 21:29:29 2006
From: str0ke at milw0rm.com (str0ke)
Subject: Re: Webmin / Usermin Arbitrary File Disclosure
	Vulnerability exploit

Jose,

It works just fine.  Tested on 7 test-bed hosts without an issue.

/str0ke

On 7/10/06, Jos? Parrella <joseparrella@...il.com> wrote:
> On 7/9/06, Alexander Hristov <joffer@...il.com> wrote:
> > Name : Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit
> > Link : http://securitydot.net/xpl/exploits/vulnerabilities/articles/1152/exploit.html
> > Date :  2006-06-30
> > Patch : update to version 1.290
> > Advisory : http://securitydot.net/vuln/exploits/vulnerabilities/articles/17885/vuln.html
>
> Has anyone tested this? I've just tested this in Webmin 1.180 (Debian
> 3.1, package revision number 3) and didn't work (I had to explicitly
> allow the attacker IP to the miniserv.conf, which is not the default
> configuration in Debian and, I think, in Webmin's original tar.gz)
>
> Jose
>