Bug 168878 – app-admin/webmin < 1.330 & app-admin/usermin < 1.260 chooser.cgi XSS (CVE-2007-1276)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Pierre-Yves Rofes (RETIRED) 2007-03-01 12:28:31 UTC]

A vulnerability has been reported in Webmin and Usermin, which can be exploited by malicious, local users to conduct script insertion attacks.

The vulnerability is caused due to an input validation error and can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site when browsing a file system containing a specially crafted filename.

Successful exploitation requires write privileges to the file system.

The vulnerability is reported in the following versions:
* Webmin versions prior to 1.330
* Usermin versions prior to 1.260

[Comment 1 Matthias Geerdsen (RETIRED) 2007-03-07 16:04:52 UTC]

beu, please bump the ebuilds

[Comment 2 Sune Kloppenborg Jeppesen (RETIRED) 2007-03-25 07:26:38 UTC]

web-apps please advise and bump as necessary.

[Comment 3 Raphael Marichez (Falco) (RETIRED) 2007-04-09 18:45:34 UTC]

web-apps please advise

[Comment 4 Sellout Bessie 2007-04-10 21:47:33 UTC]

web-apps please advise....

[Comment 5 Raúl Porcel (RETIRED) 2007-04-13 11:11:32 UTC]

app-admin/webmin-1.340
app-admin/usermin-1.270

in the tree

[Comment 6 Sune Kloppenborg Jeppesen (RETIRED) 2007-04-13 11:26:48 UTC]

Thx Raul!

Arches please test and mark stable. Target keywords are:

webmin-1.340.ebuild:KEYWORDS="alpha amd64 arm hppa ppc ppc64 s390 sh sparc x86"
usermin-1.270.ebuild:KEYWORDS="alpha amd64 hppa ppc ppc64 sparc x86"

[Comment 7 Raúl Porcel (RETIRED) 2007-04-13 11:38:35 UTC]

x86 stable

[Comment 8 Christoph Mende (RETIRED) 2007-04-13 14:52:59 UTC]

both emerge fine and work, found a small mistake in usermin though:
 * Point your web browser to http://localhost:20000 to use usermin.
it's https:// actually ;>

Portage 2.1.2.2 (default-linux/amd64/2006.1/desktop, gcc-4.1.1, glibc-2.5-r0, 2.6.20-beyond2 x86_64)
=================================================================
System uname: 2.6.20-beyond2 x86_64 AMD Athlon(tm) 64 X2 Dual Core Processor 4600+
Gentoo Base System release 1.12.9
Timestamp of tree: Fri, 13 Apr 2007 13:50:01 +0000
ccache version 2.4 [enabled]
dev-java/java-config: 1.3.7, 2.0.31-r5
dev-lang/python:     2.4.3-r4
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     2.4-r6
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.15-r1
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.17-r2
ACCEPT_KEYWORDS="amd64"
AUTOCLEAN="yes"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=k8 -Os -pipe -msse3 -w"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/java-config/vms/ /etc/php/apache1-php5/ext-active/ /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/splash /etc/terminfo"
CXXFLAGS="-march=k8 -Os -pipe -msse3 -w"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--quiet"
FEATURES="builysyspkg ccache collision-protect distlocks metadata-transfer multilib-strict nodoc noinfo parallel-fetch sandbox sfperms strict test userfetch userpriv usersandbox"
GENTOO_MIRRORS="ftp://linux.rz.ruhr-uni-bochum.de/gentoo-mirror/ ftp://ftp.uni-erlangen.de/pub/mirrors/gentoo ftp://ftp.join.uni-muenster.de/pub/linux/distributions/gentoo ftp://ftp.wh2.tu-dresden.de/pub/mirrors/gentoo ftp://ftp.join.uni-muenster.de/pub/linux/distributions/gentoo ftp://ftp-stud.fht-esslingen.de/pub/Mirrors/gentoo/ ftp://ftp.gentoo.mesh-solutions.com/gentoo/ ftp://pandemonium.tiscali.de/pub/gentoo/ "
LANG="en_US.UTF-8"
LC_ALL="en_US.UTF-8"
MAKEOPTS="-j3 -l3 -s"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_EXTRA_OPTS="--exclude-from=/etc/portage/rsync_excludes"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage/overlay"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="X a52 aac acpi alsa amd64 amr audiofile bitmap-fonts bzip2 cairo cdinstall cdr cli cracklib crypt cups dbus dri dts dvd dvdr dvdread emboss encode exif fam firefox fortran gdbm gif gstreamer gtk gtk2 hal iconv jpeg libg++ logrotate mad midi mikmod minimal mp3 mpeg ncurses nptl nptlonly offensive ogg opengl pam pcre php png ppds pppd quicktime readline reflection sdl session smp spl ssl svg symlink tcpd test tiff truetype truetype-fonts type1-fonts unicode v4l vim vorbis x264 xinerama xorg xv xvid zlib" ALSA_CARDS="emu10k1" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="evdev keyboard" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIRC_DEVICES="inputlirc" USERLAND="GNU" VIDEO_CARDS="nvidia"
Unset:  CTARGET, INSTALL_MASK, LDFLAGS, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS

[Comment 9 Peter Weller (RETIRED) 2007-04-13 15:19:47 UTC]

Both stable on amd64

[Comment 10 Jeroen Roovers (RETIRED) 2007-04-13 16:43:09 UTC]

Stable for HPPA.

[Comment 11 Markus Rothe (RETIRED) 2007-04-15 18:36:23 UTC]

ppc64 stable

[Comment 12 Gustavo Zacarias (RETIRED) 2007-04-16 12:50:02 UTC]

sparc stable.

[Comment 13 Jose Luis Rivero (yoswink) (RETIRED) 2007-04-18 09:34:38 UTC]

alpha stable

[Comment 14 Tobias Scherbaum (RETIRED) 2007-04-18 15:43:04 UTC]

ppc stable, this one is ready for GLSA decision

[Comment 15 Sune Kloppenborg Jeppesen (RETIRED) 2007-04-18 16:18:18 UTC]

I vote NO.

[Comment 16 Pierre-Yves Rofes (RETIRED) 2007-04-18 20:42:47 UTC]

voting NO too, and closing.