SNS Advisory No.88
Webmin Directory Traversal Vulnerability
Medium
Webmin for Windows contains directory traversal vulnerability that
allows remote attackers to download arbitrary files without authentication.
Webmin is a web-based system administration tool for Unix, MacOS X and
Windows platform.
Webmin 1.270 and earlier versions does not properly handle "\" (backslash).
On Windows platform, this allows attackers to access outside of the public
directory and files.
In default configurations of Webmin, it is required authentication to
access almost directories under top page. But there are some directories
where is not required authentication to access. For example, the directory
which stores the image used before login.
Therefore, by exploiting directory traversal vulnerability from these
directories, the vulnerability allows remote attackers to download the
contents of arbitrary files without authentication.
Webmin (on Windows) Version 1.270 and earlier versions
This problem can be addressed by upgrading Webmin to 1.280 or later.
Keigo Yamazaki (LAC)
This SNS Advisory is being published in coordination with Information-technology
Promotion Agency, Japan (IPA) and JPCERT/CC.
http://jvn.jp/jp/JVN%2367974490/index.html
http://www.ipa.go.jp/security/vuln/documents/2006/JVN_67974490_webmin.html
The information contained in this advisory may be revised without prior
notice and is provided as it is. Users shall take their own risk when
taking any actions following reading this advisory. LAC Co., Ltd.
shall take no responsibility for any problems, loss or damage caused
by, or by the use of information provided here.