Caldera Security Advisory: Webmin root account leak

From: Caldera Support Information <sup-info@opus.caldera.com>
Subject: Security Update: [CSSA-2001-019.0] Webmin root account leak
Date: Fri, 1 Jun 2001 11:11:33 -0600


____________________________________________________________________________
                   Caldera International, Inc.  Security Advisory

Subject:                webmin root account leak
Advisory number:        CSSA-2001-019.0
Issue date:             2001 May, 29
Cross reference:
____________________________________________________________________________


1. Problem Description

   When starting system daemons from the webmin webfrontend, webmin
   does not clear its environment variables. Since these variables
   contain the authorization of the administrator, any daemon gets
   these variables.

   A simple attack would be to write a CGI scripts which just dumps
   all environment variables and wait for the administrator to restart
   apache using webmin.

2. Vulnerable Versions

   System                       Package
   -----------------------------------------------------------
   OpenLinux 2.3                not vulnerable
                        

   OpenLinux eServer 2.3.1      All packages previous to
   and OpenLinux eBuilder       webmin-0.749-7

   OpenLinux eDesktop 2.4       All packages previous to
                                webmin-0.78-11

3. Solution

   Workaround

      none

   The proper solution is to upgrade to the latest packages.

4. OpenLinux 2.3

   not vulnerable

5. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0

   5.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.caldera.com/pub/updates/eServer/2.3/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.caldera.com/pub/updates/eServer/2.3/current/SRPMS

   5.2 Verification

       8b978c8a6a6bf56da5f3eb56a2768e6b  RPMS/webmin-0.749-7.i386.rpm
       dad6505cde59262187828d9d2b6fe0e7  SRPMS/webmin-0.749-7.src.rpm

   5.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

          /etc/rc.d/init.d/webmin stop
          rpm -Fvh webmin*i386.rpm
          /etc/rc.d/init.d/webmin start

6. OpenLinux eDesktop 2.4

   6.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.caldera.com/pub/updates/eDesktop/2.4/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.caldera.com/pub/updates/eDesktop/2.4/current/SRPMS

   6.2 Verification

       cd03a53b35407547b5f4b339fcb60fda  RPMS/webmin-0.78-11.i386.rpm
       13d2b8d05eb94f7b501c231e33b06e8d  SRPMS/webmin-0.78-11.src.rpm

   6.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

           /etc/rc.d/init.d/webmin stop
           rpm -Fvh webmin*i386.rpm
           /etc/rc.d/init.d/webmin start

7. References

   This and other Caldera security resources are located at:

   http://www.caldera.com/support/security/index.html

   This security fix closes Caldera's internal Problem Report 10039.

8. Disclaimer

   Caldera International, Inc. is not responsible for the misuse of
   any of the information we provide on this website and/or through our
   security advisories. Our advisories are a service to our customers
   intended to promote secure installation and use of Caldera OpenLinux.

9. Acknowledgements:

   Caldera International wants to thank J. Nick Koston for reporting
   the problem.
____________________________________________________________________________