Many network systems in Vietnam can be seriously affected by Webmin's error

Network Security Center (BKIS) said a serious new vulnerability discovered in Webmin software can help hackers easily break into the network using this software.

This software provides web interface for system administration on Unix and Linux operating systems.

Webmin is often used by hosting service providers to manage user accounts and folders. With this vulnerability, hackers can access any directory and read the files on the server using Webmin software.

In Vietnam, BKIS has checked and found that a number of large hosting service providers, including an ISP, are using Webmin for administering users to rent hosts. Therefore, the ability of these service providers 'customers' information such as username / password , files in the web folder, can already be collected by hackers.

At least nearly 400 customers of these service providers may be exposed to information, including banks, businesses, organizations . This is very dangerous, because with these Information obtained by hackers can fully control the website of all these customers.

Currently, in addition to Webmin, Usermin software has the same error. These two software are from the same author group, so they share the same principle, and the way to exploit the vulnerability is the same. These are two popular software and trusted by network administrators on Unix, and Linux.

The BKIS Network Security Center has recommended all network administrators across the country to check if your system uses Webmin or Usermin software, if you have to patch these software immediately. .

To fix the problem, the first thing is that administrators must upgrade the failed software to the latest version of Webmin 1.290 and Usermin 1,220 from www.webmin.com website. Next, hosting service providers need to notify and instruct their customers to hire their hosts to immediately change the host management password and the password to connect to the database (if any). Finally, review the system (for both service providers and their hosting customers) because it is likely that hackers have been able to hack in the past few days to modify information or install Backdoor (a type of spyware) to control the system.

The cause of the flaw is that the software does not strictly control the use of the ' / ' character. By using sequences of characters ' .% 01 / ', hackers can read any file contents in the system, thereby acquiring sensitive information such as usernames and passwords. Access account (via file / etc / passwd , / etc / shadow ) or retrieve account database access information (via config files containing information of the database).

L.Quang