fkie_cve-2006-4246
Vulnerability from fkie_nvd
Published
2006-09-19 18:07
Modified
2025-04-03 01:03
Severity ?
Summary
Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user.
References
security@debian.orghttp://secunia.com/advisories/21968Vendor Advisory
security@debian.orghttp://secunia.com/advisories/21981Patch, Vendor Advisory
security@debian.orghttp://sourceforge.net/tracker/index.php?func=detail&aid=1509145&group_id=17457&atid=485894Patch
security@debian.orghttp://www.debian.org/security/2006/dsa-1177Patch
security@debian.orghttp://www.osreviews.net/reviews/admin/usermin
security@debian.orghttp://www.securityfocus.com/bid/18574Patch
security@debian.orghttp://www.vupen.com/english/advisories/2006/3668
security@debian.orghttp://www.webmin.com/uchanges.htmlPatch
security@debian.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/29010
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/21968Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/21981Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/tracker/index.php?func=detail&aid=1509145&group_id=17457&atid=485894Patch
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2006/dsa-1177Patch
af854a3a-2127-422b-91ae-364da2661108http://www.osreviews.net/reviews/admin/usermin
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/18574Patch
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/3668
af854a3a-2127-422b-91ae-364da2661108http://www.webmin.com/uchanges.htmlPatch
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/29010
Impacted products
Vendor Product Version
usermin usermin *
usermin usermin 0.4
usermin usermin 0.5
usermin usermin 0.6
usermin usermin 0.7
usermin usermin 0.8
usermin usermin 0.9
usermin usermin 0.91
usermin usermin 0.92
usermin usermin 0.93
usermin usermin 0.94
usermin usermin 0.95
usermin usermin 0.96
usermin usermin 0.97
usermin usermin 0.98
usermin usermin 0.99
usermin usermin 1.000
usermin usermin 1.010
usermin usermin 1.020
usermin usermin 1.030
usermin usermin 1.040
usermin usermin 1.051
usermin usermin 1.060
usermin usermin 1.070
usermin usermin 1.080
usermin usermin 1.090
usermin usermin 1.100
usermin usermin 1.110
usermin usermin 1.120
usermin usermin 1.130
usermin usermin 1.140
usermin usermin 1.150


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:usermin:usermin:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "26B92F53-3598-44F5-8CE1-A04A28EFF92E",
              "versionEndIncluding": "1.210",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "1AD41B8B-72C0-411F-83E7-A82E1642FA26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "65A99166-28DF-4651-985F-922DBB06687E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F9EACC7-1464-4476-9AA1-50DD902A3489",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD343610-8BE2-4916-AF30-66B21330D84C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D54B4D9-5218-41F9-A701-F960199EE520",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "B352FF6B-989C-4540-B434-9452851F745C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.91:*:*:*:*:*:*:*",
              "matchCriteriaId": "F83F9841-49C7-410A-891F-365BBA043D2A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.92:*:*:*:*:*:*:*",
              "matchCriteriaId": "711485C5-F16A-4481-AEE3-E2AF1BAA09DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.93:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD5B9395-DCEA-4615-825E-1C4B42F25E2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.94:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B7162DD-DFE1-478D-B87C-28C393E20941",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.95:*:*:*:*:*:*:*",
              "matchCriteriaId": "A01D1150-FCDE-47F5-BFE6-F06A294D7B29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.96:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D673B88-A9D9-4D22-9531-7F06791BC551",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.97:*:*:*:*:*:*:*",
              "matchCriteriaId": "538021A3-2A6E-446F-B14D-4DCC7A470E55",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.98:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB1A2A26-1187-46BE-8EFC-F3C325679245",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:0.99:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E70B0A6-31C9-4D78-B4B9-E75B45B6368C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.000:*:*:*:*:*:*:*",
              "matchCriteriaId": "C70274C3-7CA0-49A2-B63C-7DAF492CCD0B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.010:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7C4A319-0EA6-47E0-831A-27530DCF714E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.020:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1009D90-9851-441B-A2E2-FA5B676E8182",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.030:*:*:*:*:*:*:*",
              "matchCriteriaId": "934A3D3F-CF10-478C-9206-DB468BCA4702",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.040:*:*:*:*:*:*:*",
              "matchCriteriaId": "77B42570-F094-4C25-B246-6439D3FF4B30",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.051:*:*:*:*:*:*:*",
              "matchCriteriaId": "69A30BB5-2C3F-4C39-8CDC-CC0CC280384C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.060:*:*:*:*:*:*:*",
              "matchCriteriaId": "753BF8DE-D225-4301-A6A6-50CD60B34234",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.070:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC37A972-11D7-4C85-A8DC-5EDE808629F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.080:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA7131C0-4FE1-4D69-9B21-8A9BFADE2A2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.090:*:*:*:*:*:*:*",
              "matchCriteriaId": "6499BF74-CA64-4192-A45F-0D8B30C1FF37",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.100:*:*:*:*:*:*:*",
              "matchCriteriaId": "C0E9BC53-C2EC-43B8-9B5D-40675CF4C335",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.110:*:*:*:*:*:*:*",
              "matchCriteriaId": "4702AEBE-E774-4015-974C-761901D50697",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.120:*:*:*:*:*:*:*",
              "matchCriteriaId": "9AC9875A-3D23-4E4B-9A18-F8F86A62E5DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.130:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AED1941-33C5-4C29-BC85-F43B0BE3920B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.140:*:*:*:*:*:*:*",
              "matchCriteriaId": "D05ED34F-0D69-4A4F-B59B-15437E991075",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:usermin:usermin:1.150:*:*:*:*:*:*:*",
              "matchCriteriaId": "B443FCF7-5949-4084-BA55-74F45A8ADB66",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root\u0027s shell instead of the shell of a specified user."
    },
    {
      "lang": "es",
      "value": "Usermin anterior a 1.220 (20060629) permite a atacantes remotos leer ficheros de su elecci\u00f3n, posiblemente relacionado con que chfn/save.cgi no est\u00e1 manejando adecuadamente un par\u00e1metro shell vac\u00edo, lo cual provoca un cambio al shell de root en vez de al shell del usuario especificado."
    }
  ],
  "evaluatorSolution": "This vulnerability is addressed in the following product release:\r\nWebmin, Usermin, 1.220",
  "id": "CVE-2006-4246",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 3.6,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-09-19T18:07:00.000",
  "references": [
    {
      "source": "security@debian.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21968"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21981"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Patch"
      ],
      "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1509145\u0026group_id=17457\u0026atid=485894"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.debian.org/security/2006/dsa-1177"
    },
    {
      "source": "security@debian.org",
      "url": "http://www.osreviews.net/reviews/admin/usermin"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/18574"
    },
    {
      "source": "security@debian.org",
      "url": "http://www.vupen.com/english/advisories/2006/3668"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.webmin.com/uchanges.html"
    },
    {
      "source": "security@debian.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29010"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21968"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21981"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1509145\u0026group_id=17457\u0026atid=485894"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.debian.org/security/2006/dsa-1177"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osreviews.net/reviews/admin/usermin"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/18574"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/3668"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.webmin.com/uchanges.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29010"
    }
  ],
  "sourceIdentifier": "security@debian.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.