fkie_cve-2003-0101
Vulnerability from fkie_nvd
Published
2003-03-03 05:00
Modified
2025-04-03 01:03
Severity ?
Summary
miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges.
References
cve@mitre.orgftp://patches.sgi.com/support/free/security/advisories/20030602-01-I
cve@mitre.orghttp://archives.neohapsis.com/archives/hp/2003-q1/0063.html
cve@mitre.orghttp://archives.neohapsis.com/archives/linux/engarde/2003-q1/0008.html
cve@mitre.orghttp://marc.info/?l=bugtraq&m=104610245624895&w=2
cve@mitre.orghttp://marc.info/?l=bugtraq&m=104610300325629&w=2
cve@mitre.orghttp://marc.info/?l=bugtraq&m=104610336226274&w=2
cve@mitre.orghttp://marc.info/?l=webmin-announce&m=104587858408101&w=2
cve@mitre.orghttp://secunia.com/advisories/8115
cve@mitre.orghttp://secunia.com/advisories/8163
cve@mitre.orghttp://www.ciac.org/ciac/bulletins/n-058.shtml
cve@mitre.orghttp://www.debian.org/security/2003/dsa-319
cve@mitre.orghttp://www.iss.net/security_center/static/11390.phpVendor Advisory
cve@mitre.orghttp://www.lac.co.jp/security/english/snsadv_e/62_e.html
cve@mitre.orghttp://www.linuxsecurity.com/advisories/gentoo_advisory-2886.html
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDKSA-2003:025
cve@mitre.orghttp://www.securityfocus.com/bid/6915
cve@mitre.orghttp://www.securitytracker.com/id?1006160
af854a3a-2127-422b-91ae-364da2661108ftp://patches.sgi.com/support/free/security/advisories/20030602-01-I
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/hp/2003-q1/0063.html
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/linux/engarde/2003-q1/0008.html
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=104610245624895&w=2
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=104610300325629&w=2
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=104610336226274&w=2
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=webmin-announce&m=104587858408101&w=2
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/8115
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/8163
af854a3a-2127-422b-91ae-364da2661108http://www.ciac.org/ciac/bulletins/n-058.shtml
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2003/dsa-319
af854a3a-2127-422b-91ae-364da2661108http://www.iss.net/security_center/static/11390.phpVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.lac.co.jp/security/english/snsadv_e/62_e.html
af854a3a-2127-422b-91ae-364da2661108http://www.linuxsecurity.com/advisories/gentoo_advisory-2886.html
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDKSA-2003:025
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/6915
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1006160
Impacted products
Vendor Product Version
engardelinux guardian_digital_webtool 1.2
usermin usermin 0.4
usermin usermin 0.5
usermin usermin 0.6
usermin usermin 0.7
usermin usermin 0.8
usermin usermin 0.9
usermin usermin 0.91
usermin usermin 0.92
usermin usermin 0.93
usermin usermin 0.94
usermin usermin 0.95
usermin usermin 0.96
usermin usermin 0.97
usermin usermin 0.98
usermin usermin 0.99
webmin webmin 1.0.50
webmin webmin 1.0.60


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:engardelinux:guardian_digital_webtool:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "91EB3988-0BFD-4BE8-A170-A99A32222540",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "1AD41B8B-72C0-411F-83E7-A82E1642FA26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "65A99166-28DF-4651-985F-922DBB06687E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F9EACC7-1464-4476-9AA1-50DD902A3489",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD343610-8BE2-4916-AF30-66B21330D84C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D54B4D9-5218-41F9-A701-F960199EE520",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "B352FF6B-989C-4540-B434-9452851F745C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.91:*:*:*:*:*:*:*",
              "matchCriteriaId": "F83F9841-49C7-410A-891F-365BBA043D2A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.92:*:*:*:*:*:*:*",
              "matchCriteriaId": "711485C5-F16A-4481-AEE3-E2AF1BAA09DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.93:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD5B9395-DCEA-4615-825E-1C4B42F25E2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.94:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B7162DD-DFE1-478D-B87C-28C393E20941",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.95:*:*:*:*:*:*:*",
              "matchCriteriaId": "A01D1150-FCDE-47F5-BFE6-F06A294D7B29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.96:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D673B88-A9D9-4D22-9531-7F06791BC551",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.97:*:*:*:*:*:*:*",
              "matchCriteriaId": "538021A3-2A6E-446F-B14D-4DCC7A470E55",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.98:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB1A2A26-1187-46BE-8EFC-F3C325679245",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.99:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E70B0A6-31C9-4D78-B4B9-E75B45B6368C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:webmin:webmin:1.0.50:*:*:*:*:*:*:*",
              "matchCriteriaId": "C968FBE9-191A-40B1-9A69-BF24511E40B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:webmin:webmin:1.0.60:*:*:*:*:*:*:*",
              "matchCriteriaId": "D89047FD-39F0-4614-B1EC-D13BAF57405E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges."
    },
    {
      "lang": "es",
      "value": "miniserv.pl en Webmin anterior a 1.070 y Usermin antes de 1.000 no maneja adecuadamente metacaract\u00e9res como avance de l\u00ednea y retorno de carro (CRLF) en cadenas codificadas en Base-64 durante la autenticaci\u00f3n b\u00e1sica, lo que permite a atacantes remotos suplantar un ID de sesi\u00f3n y ganar privilegios de root."
    }
  ],
  "id": "CVE-2003-0101",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2003-03-03T05:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20030602-01-I"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/hp/2003-q1/0063.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/linux/engarde/2003-q1/0008.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=104610245624895\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=104610300325629\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=104610336226274\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=webmin-announce\u0026m=104587858408101\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/8115"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/8163"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ciac.org/ciac/bulletins/n-058.shtml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2003/dsa-319"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.iss.net/security_center/static/11390.php"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.lac.co.jp/security/english/snsadv_e/62_e.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.linuxsecurity.com/advisories/gentoo_advisory-2886.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:025"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/6915"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1006160"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20030602-01-I"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/hp/2003-q1/0063.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/linux/engarde/2003-q1/0008.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=104610245624895\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=104610300325629\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=104610336226274\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=webmin-announce\u0026m=104587858408101\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/8115"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/8163"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ciac.org/ciac/bulletins/n-058.shtml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2003/dsa-319"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.iss.net/security_center/static/11390.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.lac.co.jp/security/english/snsadv_e/62_e.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.linuxsecurity.com/advisories/gentoo_advisory-2886.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:025"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/6915"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1006160"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.