Description
Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges.
References
- 2795 vdb-entry
- 20010526 Webmin Doesn't Clean Env (root exploit) mailing-list
- webmin-gain-information(6627) vdb-entry
- CSSA-2001-019.1 vendor-advisory
- MDKSA-2001:059 vendor-advisory