Webmin Format String Vulnerability (Perl, miniserv.pl)
1 Dec. 2005
Summary
Webmin - "A web-based interface for system administration for Unix. Setup user accounts, DNS, file sharing and the program is freeware."
The webmin `miniserv.pl' web server component has been found to be vulnerable to a new class of exploitable (remote code) Perl format string vulnerabilities.
Credit:
The information has been provided by Jack Louis.
Vulnerable Systems:
* All Webmin versions are suspected
During the login process it is possible to trigger this vulnerability via a crafted username parameter containing format string data. In the observed configuration the process was running as the user root, so so if remote code execution is successful, it would lead to a full remote root compromise in the default configuration. A valid login is not required to trigger this vulnerability, only access to the miniserv.pl port (default 10000).
The username parameter of the login form is logged via the perl `syslog' facility in an unsafe manner during a unknown user login attempt. the perl syslog facility passes the username on to the variable argument function sprintf that will treat any format specifiers and process them accordingly.
The vectors for a simple DoS of the web server are to use the %n and %0(large number)d inside of the username parameter, with the former causing a write protection fault within perl leading to script abortion, and the latter causing a large amount of memory to be allocated inside of the perl process.
A generic remote code execution exploit method has been developed by a third party that is reachable though this hole itself.
The following is the section of code in question. (from miniserv.pl)
if ($use_syslog && !$validated) {
syslog("crit",
($nonexist ? "Non-existent" :
$expired ? "Expired" : "Invalid").
" login as $authuser from $acpthost");
}
As can be clearly seen with this section of code, the user supplied data is clearly within the format specification of the syslog call.
Fix:
There is an official fix for this issue at the main webmin site.
