Vulnerabilities > CVE-2002-0757 - Authentication Bypass vulnerability in Webmin / Usermin

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
usermin
webmin
nessus

Summary

(1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID combinations.

Nessus

  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2002-033.NASL
    descriptionA vulnerability exists in all versions of Webmin prior to 0.970 that allows a remote attacker to login to Webmin as any user. All users of Webmin are encouraged to upgrade immediately. Users of Mandrake Linux 8.0 and earlier will need to install some additional perl modules for this new version of webmin to work correctly.
    last seen2020-06-01
    modified2020-06-02
    plugin id13939
    published2004-07-31
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/13939
    titleMandrake Linux Security Advisory : webmin (MDKSA-2002:033)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandrake Linux Security Advisory MDKSA-2002:033. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(13939);
      script_version ("1.15");
      script_cvs_date("Date: 2019/08/02 13:32:46");
    
      script_cve_id("CVE-2002-0757");
      script_xref(name:"MDKSA", value:"2002:033");
    
      script_name(english:"Mandrake Linux Security Advisory : webmin (MDKSA-2002:033)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandrake Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A vulnerability exists in all versions of Webmin prior to 0.970 that
    allows a remote attacker to login to Webmin as any user. All users of
    Webmin are encouraged to upgrade immediately.
    
    Users of Mandrake Linux 8.0 and earlier will need to install some
    additional perl modules for this new version of webmin to work
    correctly."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.geocrawler.com/lists/3/SourceForge/12082/0/8595354/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Update the affected perl-Authen-PAM, perl-Net_SSLeay and / or webmin
    packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:perl-Authen-PAM");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:perl-Net_SSLeay");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:webmin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:7.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:7.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:8.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:8.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:8.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2002/05/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/31");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK7.1", cpu:"i386", reference:"perl-Authen-PAM-0.12-1.1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK7.1", cpu:"i386", reference:"perl-Net_SSLeay-1.05-4.1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK7.1", reference:"webmin-0.970-1.3mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK7.2", cpu:"i386", reference:"perl-Authen-PAM-0.12-1.1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK7.2", reference:"webmin-0.970-1.3mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK8.0", cpu:"i386", reference:"perl-Authen-PAM-0.12-1.1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.0", reference:"webmin-0.970-1.2mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK8.1", reference:"webmin-0.970-1.1mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK8.2", reference:"webmin-0.970-1.1mdk", yank:"mdk")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyCGI abuses
    NASL idWEBMIN_0_96.NASL
    descriptionAccording to its self-reported version, the Webmin install hosted on the remote host is 0.96 It is, therefore, affected by multiple vulnerabilities: - A cross site scripting vulnerability which may allow attackers to insert arbitrary code. (CVE-2002-0756) - An authentication bypass which may allow attackers to login using arbitrary credentials (CVE-2002-0757)
    last seen2020-06-01
    modified2020-06-02
    plugin id108539
    published2018-03-22
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108539
    titleWebmin 0.96 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(108539);
      script_version("1.3");
      script_cvs_date("Date: 2019/11/08");
    
      script_cve_id("CVE-2002-0756", "CVE-2002-0757");
    
      script_name(english:"Webmin 0.96 Multiple Vulnerabilities");
      script_summary(english:"Checks version of Webmin.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote web server is affected by multiple security vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "According to its self-reported version, the Webmin install hosted on
    the remote host is 0.96 It is, therefore, affected by multiple
    vulnerabilities:
    
      - A cross site scripting vulnerability which may allow
        attackers to insert arbitrary code. (CVE-2002-0756)
    
      - An authentication bypass which may allow attackers
        to login using arbitrary credentials (CVE-2002-0757)");
      script_set_attribute(attribute:"see_also", value:"https://www.securityfocus.com/bid/4700");
      script_set_attribute(attribute:"see_also", value:"http://www.webmin.com/changes.html");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Webmin 0.97 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2002/08/12");
      script_set_attribute(attribute:"patch_publication_date", value:"2002/08/12");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/22");
    
      script_set_attribute(attribute:"potential_vulnerability", value:"true");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:webmin:webmin");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("webmin.nasl");
      script_require_keys("www/webmin", "Settings/ParanoidReport");
      script_require_ports("Services/www", 10000);
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    
    app = 'Webmin';
    port = get_http_port(default:10000, embedded: TRUE);
    
    get_kb_item_or_exit('www/'+port+'/webmin');
    version = get_kb_item_or_exit('www/webmin/'+port+'/version', exit_code:1);
    source = get_kb_item_or_exit('www/webmin/'+port+'/source', exit_code:1);
    
    if (report_paranoia < 2) audit(AUDIT_PARANOID);
    
    dir = "/";
    install_url = build_url(port:port, qs:dir);
    
    fix = "0.97";
    
    if (ver_compare(ver:version, fix:"0.96", strict:FALSE) == 0)
    {
      report =
        '\n  URL               : ' + install_url +
        '\n  Version Source    : ' + source +
        '\n  Installed version : ' + version +
        '\n  Fixed version     : ' + fix + '\n';
    
      security_report_v4(severity:SECURITY_HOLE, port:port, extra:report, xss:TRUE);
    }
    else audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url, version);