Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: Webmin BruteForce + Command execution - By Di42lo <DiAblo_2 () 012 net il>
From: Martin Mewes <mm () mewes tv>
Date: Thu, 23 Dec 2004 10:34:59 +0100

Hello,

amit sides <DiAblo_2 () 012 net il> wrote :
#!/usr/bin/perl
##
# Webmin BruteForce + Command execution - By Di42lo
<DiAblo_2 () 012 net il> #
# usage
# ./bruteforce.webmin.pl <host> <command>
[...]

this is a message from the maintainer ...

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I haven't seen this one before - but it would be blocked by Webmin's
password timeouts feature. However, this feature (surprisingly!) isn't
enabled by default ... 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

On behalf of the maintainer I appreciate every input to secure the 
software to its extend. Future versions of Webmin (if needed Usermin 
too) will have this feature enabled by default.

With this we encourage everyone using Webmin to enable this feature to 
avoid a possible break-in.

Again, we would like to tell the OP of this that it would be really nice 
to know first about such issues, so we are ablte to / can do a 
(full-)disclosure on items.
   
   
bis dahin/kind regards
   
Martin Mewes - Webmin Translation Team
   
-- 
I'm not really out of the office. I'm just ignoring you.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault