Debian Bug report logs - #381537
CVE-2006-3392: Arbitrary file disclosure in webmin

version graph

Package: webmin; Maintainer for webmin is (unknown);

Reported by: Stefan Fritsch <sf@sfritsch.de>

Date: Sat, 5 Aug 2006 09:03:42 UTC

Severity: grave

Tags: security

Found in version webmin/1.180-3

Fixed in version 1.230-1+rm

Done: Marco Rodrigues <gothicx@sapo.pt>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian Security Team <team@security.debian.org>, Debian Webmin maintainers <webmin-maintainers@lists.alioth.debian.org>:
Bug#381537; Package webmin. Full text and rfc822 format available.

Acknowledgement sent to Stefan Fritsch <sf@sfritsch.de>:
New Bug report received and forwarded. Copy sent to Debian Security Team <team@security.debian.org>, Debian Webmin maintainers <webmin-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Stefan Fritsch <sf@sfritsch.de>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: CVE-2006-3392: Arbitrary file disclosure in webmin
Date: Sat, 05 Aug 2006 10:57:11 +0200
Package: webmin
Version: 1.180-3
Severity: grave
Tags: security
Justification: user security hole



CVE-2006-3392 reads:
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path
function before decoding HTML, which allows remote attackers to read
arbitrary files, as demonstrated using "..%01" sequences, which bypass
the removal of "../" sequences before bytes such as "%01" are removed
from the filename.  NOTE: This is a different issue than
CVE-2006-3274.



Reply sent to Marco Rodrigues <gothicx@sapo.pt>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Stefan Fritsch <sf@sfritsch.de>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #10 received at 381537-done@bugs.debian.org (full text, mbox):

From: Marco Rodrigues <gothicx@sapo.pt>
To: 381537-done@bugs.debian.org
Subject: webmin has been removed from Debian, closing #381537
Date: Fri, 23 May 2008 17:51:02 +0100
Version: 1.230-1+rm

The webmin package has been removed from Debian testing, unstable and
experimental, so I am now closing the bugs that were still opened
against it.

For more information about this package's removal, read
http://bugs.debian.org/343897 . That bug might give the reasons why
this package was removed, and suggestions of possible replacements.

Don't hesitate to reply to this mail if you have any question.

Thank you for your contribution to Debian.

--
Marco Rodrigues
http://Marco.Tondela.org




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 10 Aug 2008 13:33:51 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Thu Apr 17 01:31:53 2014; Machine Name: beach.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.