Description
miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters (line feed or carriage return).
References
- 16858 third-party-advisory
- 17282 third-party-advisory
- GLSA-200509-17 vendor-advisory
- 19575 vdb-entry
- 17 third-party-advisory
- 14889 vdb-entry
- ADV-2005-1791 vdb-entry
- http://www.lac.co.jp/business/sns/intelligence/SNSadvisory_e/83_e.html
- MDKSA-2005:176 vendor-advisory
- SUSE-SR:2005:024 vendor-advisory
- 20050921 [SNS Advisory No.83] Webmin/Usermin PAM Authentication Bypass Vulnerability mailing-list
- http://www.webmin.com/changes-1.230.html
- JVN#40940493 third-party-advisory
- http://www.webmin.com/uchanges-1.160.html