CVE-2006-3392

Published: 6 July 2006

Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.

Priority

Status

Package	Release	Status
webmin Launchpad, Ubuntu, Debian	dapper	Does not exist
	edgy	Does not exist
	feisty	Does not exist
	upstream	Needs triage

References

https://www.cve.org/CVERecord?id=CVE-2006-3392
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.