CVE - CVE-2005-3912

CVE-ID
CVE-2005-3912	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service (crash or memory consumption) and possibly execute arbitrary code via format string specifiers in the username parameter to the login form, which is ultimately used in a syslog call. NOTE: the code execution might be associated with an issue in Perl.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BUGTRAQ:20051129 Webmin miniserv.pl format string vulnerability URL:http://www.securityfocus.com/archive/1/418093/100/0/threaded CONFIRM:http://www.webmin.com/changes-1.250.html CONFIRM:http://www.webmin.com/security.html CONFIRM:http://www.webmin.com/uchanges-1.180.html DEBIAN:DSA-1199 URL:http://www.debian.org/security/2006/dsa-1199 GENTOO:GLSA-200512-02 URL:http://www.gentoo.org/security/en/glsa/glsa-200512-02.xml MANDRIVA:MDKSA-2005:223 URL:~~http://www.mandriva.com/security/advisories?name=MDKSA-2005:223~~ (Obsolete source) MISC:http://www.dyadsecurity.com/webmin-0001.html MLIST:[Dailydave] 20051129 Webmin miniserv.pl format string vulnerability URL:http://lists.immunitysec.com/pipermail/dailydave/2005-November/002685.html SECUNIA:17749 URL:http://secunia.com/advisories/17749 SECUNIA:17817 URL:http://secunia.com/advisories/17817 SECUNIA:17878 URL:http://secunia.com/advisories/17878 SECUNIA:17942 URL:http://secunia.com/advisories/17942 SECUNIA:18101 URL:http://secunia.com/advisories/18101 SECUNIA:22556 URL:http://secunia.com/advisories/22556 SUSE:SUSE-SR:2005:030 URL:http://www.novell.com/linux/security/advisories/2005_30_sr.html VUPEN:ADV-2005-2660 URL:~~http://www.vupen.com/english/advisories/2005/2660~~ (Obsolete source)
Assigning CNA
MITRE Corporation
Date Record Created
20051130	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20051130)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)