OSVDB ID: 9775 Title: Usermin Installation .webmin Symlink Privilege Escalation |
Info |
|
|
Dates |
||||
|
|
Description |
Usermin contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when the /tmp/.webmin directory has been created prior to installation. It is possible for a malicious user to create a symlink to any other file on the system, which would be overwritten when Usermin writes to the link filename, resulting in a loss of integrity. |
Classification |
Location:
Local Access Required,
Remote/Network Access Required
Attack Type: Input Manipulation, Race Condition Impact: Loss of Integrity Exploit: Exploit Available Disclosure: OSVDB Verified |
Solution |
Upgrade to version 1.090 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |