CVE

Id
5147  
CVE No.
CVE-2002-0757  
Status
Candidate  
Description
(1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID combinations.  
Phase
Proposed (20020726)  
Votes
ACCEPT(2) Baker, Cole | NOOP(5) Armstrong, Christey, Cox, Foat, Wall  
Comments
Christey> This *might* be vendor acknowledgement: | URL:http://www.geocrawler.com/lists/3/SourceForge/12082/0/8595354/ | | However, the person who"s credited by the vendor found *TWO* | authentication-related vulnerabilities at about the same time, | and the vendor is clearly fixing "a" vulnerability. So, which | issue did the vendor fix? Which issue is the vendor | acknowledging - CVE-2002-0757 or CVE-2002-0756?  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
27168 5147 CVE-2002-0757 BUGTRAQ:20020508 [SNS Advisory No.53] Webmin/Usermin Session ID Spoofing Vulnerability  View
27169 5147 CVE-2002-0757 URL:http://online.securityfocus.com/archive/1/271466  View
27170 5147 CVE-2002-0757 MANDRAKE:MDKSA-2002:033  View
27171 5147 CVE-2002-0757 URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-033.php  View
27172 5147 CVE-2002-0757 XF:webmin-usermin-sessionid-spoof(9037)  View
27173 5147 CVE-2002-0757 URL:http://www.iss.net/security_center/static/9037.php  View
27174 5147 CVE-2002-0757 BID:4700  View

Related JVN