CVE-2005-3912

HIGH 7.5CVE-2005-3912 · Published 30/11/2005 · updated 16/06/2026

Package	Affected versions	Patched versions
webmin webmin	`≥ 1.100, < 1.180≥ 1.200, < 1.250`	`1.1801.250`

Description

Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service (crash or memory consumption) and possibly execute arbitrary code via format string specifiers in the username parameter to the login form, which is ultimately used in a syslog call. NOTE: the code execution might be associated with an issue in Perl.

References

lists.immunitysec.com/pipermail/dailydave/2005-November/002685.html · Patch
secunia.com/advisories/17749 · Patch
secunia.com/advisories/17817 · Third Party Advisory
secunia.com/advisories/17878 · Third Party Advisory
secunia.com/advisories/17942 · Third Party Advisory
secunia.com/advisories/18101 · Third Party Advisory
secunia.com/advisories/22556 · Third Party Advisory
debian.org/security/2006/dsa-1199 · Third Party Advisory
dyadsecurity.com/webmin-0001.html · Patch
gentoo.org/security/en/glsa/glsa-200512-02.xml · Third Party Advisory
mandriva.com/security/advisories · Third Party Advisory
novell.com/linux/security/advisories/2005_30_sr.html · Third Party Advisory
securityfocus.com/archive/1/418093/100/0/threaded · Third Party Advisory
vupen.com/english/advisories/2005/2660 · Third Party Advisory
webmin.com/changes-1.250.html · Vendor Advisory
webmin.com/security.html · Vendor Advisory
webmin.com/uchanges-1.180.html · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free