Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Wednesday August 21 2019, @08:15AM   Printer-friendly
from the creeping-around-the-back-door dept.

Submitted via IRC for SoyCow2718

Webmin, the open source web-based interface for managing Linux and UNIX systems, contained a remote code execution vulnerability for more than a year and it's believed to be an intentional backdoor.

The vulnerability, tracked as CVE-2019-15107, was disclosed at the recent DEFCON hacker conference, and Webmin developers were not notified of its existence before the details were made public.

The flaw is related to a feature designed for changing expired passwords and it allows a remote, unauthenticated attacker to execute arbitrary commands with root privileges.

The security hole impacts Webmin 1.882 through 1.921, but most versions are not vulnerable in their default configuration as the affected feature is not enabled by default. Version 1.890 is affected in the default configuration. The issue has been addressed with the release of Webmin 1.930 and Usermin version 1.780.

[...] A Shodan search shows over 215,000 internet-exposed Webmin instances, mostly located in the United States, France and Germany. However, there are roughly 15,000 results for searches of version 1.890, which is vulnerable in the default configuration.

Source: https://www.securityweek.com/webmin-backdoored-over-year


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 1, Informative) by Anonymous Coward on Wednesday August 21 2019, @10:32AM (2 children)

    by Anonymous Coward on Wednesday August 21 2019, @10:32AM (#883046)

    You do realize that SF was in the same deal as /.? Dime is who you can thank for all that.

    Starting Score:    0  points
    Moderation   +1  
       Informative=1, Total=1
    Extra 'Informative' Modifier   0  

    Total Score:   1  
  • (Score: 3, Insightful) by isostatic on Wednesday August 21 2019, @11:46AM (1 child)

    by isostatic (365) on Wednesday August 21 2019, @11:46AM (#883061) Journal

    Since then it was bought by someone who genuinely seems to be trying to turn it round.

    • (Score: 2) by DannyB on Wednesday August 21 2019, @04:34PM

      by DannyB (5839) Subscriber Badge on Wednesday August 21 2019, @04:34PM (#883209) Journal

      But well after Dice destroyed any trust that anyone once had.

      Trust is hard to earn, easy to destroy.

      --
      People today are educated enough to repeat what they are taught but not to question what they are taught.