|
|
Family: Gentoo Local Security Checks --> Category: infos
[GLSA-200406-15] Usermin: Multiple vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
Usermin: Multiple vulnerabilities
Detailed Explanation for this Vulnerability Test
The remote host is affected by the vulnerability described in GLSA-200406-15
(Usermin: Multiple vulnerabilities)
Usermin contains two security vulnerabilities. One fails to properly
sanitize email messages that contain malicious HTML or script code and the
other could allow a possible hacker to lock out a valid user by sending an
invalid username and password.
Impact
By sending a specially crafted e-mail, a possible hacker can execute arbitrary
scripts running in the context of the victim's browser. This can be lead to
cookie theft and potentially to compromise of user accounts. Furthermore,
a possible hacker could lock out legitimate users by sending invalid login
information.
Workaround
There is no known workaround at this time. All users are encouraged to
upgrade to the latest available version.
References:
http://www.securityfocus.com/bid/10521
http://www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/75_e.html
Solution:
Usermin users should upgrade to the latest version:
# emerge sync
# emerge -pv ">=app-admin/usermin-1.080"
# emerge ">=app-admin/usermin-1.080"
Threat Level: Medium
Click HERE for more information and discussions on this network vulnerability scan.
|
